ConnectWise customers hit by supply-chain attack linked to compromised API secret
Hundreds of ConnectWise customers have been caught up in a supply-chain attack after a compromised API secret gave attackers a path into connected Microsoft 365 environments. The stolen credential allowed the intrusion to proceed without triggering normal access controls.
Why this matters: ConnectWise sells software that IT teams use to manage other companies' systems. That makes it a high-value target. One stolen API secret was enough to reach hundreds of downstream customers and their Microsoft 365 accounts. This is the supply-chain problem in plain form: you can do everything right internally and still get hit because someone in your toolchain got compromised. Every company using ConnectWise should be asking right now what those connected credentials could actually reach.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.