Microsoft researchers identified a China-state aligned threat group, Storm-0940, as the culprit behind an attack on ConnectWise’s Cloud Backup service, which compromised over 2,250 tenants.
Earlier attacks and coverage
- ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenants (2026-10-19)
Business impact
The attack could lead to significant financial losses and operational disruptions for affected organizations, as well as potential legal and reputational damage due to data breaches.
Industries affected
The threat group targeted a broad range of industries, including aerospace, automotive, chemicals, and financial services.
Users affected
ConnectWise Cloud Backup customers were the primary target, with their Microsoft 365 environments compromised through the use of AI agents and malicious infrastructure.
