AI agents accessed 2,250 firms after ConnectWise backup hack
In brief
According to Microsoft, China state-aligned hackers broke into ConnectWise's cloud backup, stole credentials linking it to customers, and could sign in to those Microsoft environments to read emails and files. Microsoft says AI agents based on the open-source ARTEX framework then ran nearly 3,000 sign-in attempts per minute and reached about 2,250 organisations. ConnectWise has paused the backup service, is investigating, and is working to restore it.
What it changes for an SME
If you rely on ConnectWise cloud backup, attackers who stole vendor credentials could sign in to your Microsoft environment and read emails and files. Microsoft says AI agents then tried nearly 3,000 logins per minute, which is faster than a small IT team can usually block. ConnectWise has paused that backup service while it investigates, so restore jobs may be delayed. The concrete issues for an SME are third-party access risk and possible interruption of backups.
What you can do
- Ask ConnectWise or your IT provider whether your organisation used the affected cloud backup and whether application credentials have been rotated.
- Turn on or verify multi-factor authentication for Microsoft 365 and for backup or remote-access tools.
- List third-party apps that can sign in to your cloud as an authorised user and remove any you no longer need.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.