Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed
ConnectWise
MSP tooling / Microsoft 365 backup · U.S. provider (FL); tenants multinational, mostly unnamed
What happened
Credentials of ConnectWise's multi-tenant Microsoft Entra applications, which customers had consented into their own Microsoft 365 tenants. The attacker used them for app-only Microsoft Graph access, which needs no user sign-in. Confirmed in subsets: successful unauthorized sign-ins in over 300 tenants (Huntress, 17 Oct; 162 confirmed by 16 Oct), self-assigned directory roles in about 50 tenants, and a Global Administrator self-grant with long-lived persistence in one tenant (Huntress, Microsoft).
About two weeks without Microsoft 365 backups for ConnectWise Cloud Backup partners; each partner must re-authorize every tenant through a replacement app; SaaS Security and Cloud Management were last stated as suspended (21 Oct) and later updates do not mention them; review of persistence inside each tenant is left to partners and tenants.
Confirmed affected parties
- Over 300 unnamed Microsoft 365 tenants with confirmed unauthorized sign-ins (Huntress)
- One unnamed partner tenant with a self-granted Global Administrator role
- Nine unnamed tenants monitored by Todyl
- Unnamed tenants monitored by Sophos (count not given)
What remains unknown
- Initial access vector into ConnectWise
- How many tenants still hold attacker-planted secrets or role grants
- Sectors of the confirmed tenants (no source states them)
- Whether Cloud Management and SaaS Security are restored
- Whether any data was read through issued tokens (app reads are not fully logged)
Losses: unknown; none disclosed
Capital around this company
Business development companies holding this company's debt, from their SEC schedules for the period ending 2026-06-30. That period ends before the incident was disclosed, so these marks show the position at risk, not the incident's effect. Marks dated 2026-09-30 also predate the incident. The first marks that can reflect it are dated 2026-12-31. This is a statement about dates, not a claim that any lender will mark the loan down.
These funds hold the debt directly. 2 more funds hold positions through joint ventures or senior loan programs ($20.1M at fair value), not counted above. Holding a company's debt is a financial exposure to it. It does not mean the lender was affected by the incident. Full credit record: ConnectWise, LLC.
Sources
- ConnectWise Trust Center advisory: Cloud Backup (formerly SkyKick) Service Interruption · 2026-10-16T17:47Z (last updated 2026-10-30T21:00Z)
- ConnectWise status page: Cloud Backup Issue Investigation · 2026-10-28T17:09Z (latest Cloud Backup update)
- Huntress: Vendor credential enables unauthorized access · 2026-10-16 (updated 2026-10-27T18:30Z)
- Microsoft Security Blog: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise · 2026-10-21
- Sophos X-Ops: ConnectWise Cloud Backup application abused in token sweep · 2026-10 (undated page)
- The Hacker News: Hackers use compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants · 2026-10-17
- BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply chain attack (Todyl nine-tenant analysis; Reddit PIM alert); search snippets via CSO Online and Daily Security Review (Todyl primary post not found) · 2026-10-17
- Field Effect: ConnectWise Cloud Backup identities (baseline v1-s05, not reopened) · 2026-10-19
Do you lend to ConnectWise, or to companies that depend on it?
We map a company or a whole book against verified incidents: the lenders, owners and providers around each holding, with what is confirmed and what is not.