ConnectWise suspends backup service after attackers abuse its Microsoft 365 access

What happened

On 17 October 2026, ConnectWise suspended its Cloud Backup, SaaS Security and Cloud Management services after attackers used compromised application credentials to access customers' Microsoft 365 accounts ^[1]. The company said it was investigating the incident with external cybersecurity experts and had notified affected customers.

The attack used application credentials, which are like a master key: once compromised, they let an attacker reach resources the application is allowed to touch, without needing each user's password. For customers, the question that follows is which of their data was accessed, by whom and when.

For ConnectWise, the incident triggers reporting duties under multiple regulations. In Sweden, the Cybersecurity Act requires a significant incident to be reported in three stages: early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report within a month ^[2]. Under CRA, which applies from 11 September 2026, a manufacturer must report an actively exploited vulnerability or a serious incident through ENISA's platform, also with short deadlines ^[3].

The 24-hour rule works like a lost bank card

When you lose your bank card, the clock starts ticking the moment you notice it's gone, not when you've had time to think about it. The same applies to incident reporting. The Swedish Cybersecurity Act's 24-hour deadline for early warning counts from when the organisation became aware of a significant incident ^[2].

That is stricter than it sounds. If the first detection happens at 3pm on a Friday, the early warning is due by 3pm on Saturday, even if nobody works weekends. The law does not pause for investigation, internal meetings or time zone differences.

For ConnectWise, the question is when it became aware that the credentials were compromised and customer data was at risk. That moment starts the clock for the early warning, the 72-hour incident notification and the final report ^[2].

The evidence both sides need

When a third party's systems access your data, two records matter: theirs and yours.

ConnectWise needs to show what its systems accessed, when the compromise happened, which accounts were affected and when it detected the problem. Its customers need to show which of their data was reached, by whom and when. If those two records don't match, someone has a problem.

Access logs are the natural place to look, but they are kept by the party whose systems did the accessing. ConnectWise keeps its logs, and each customer keeps theirs. In a dispute, the side without its own intact record starts on the back foot.

That is where a digital witness fits. It doesn't replace logging, monitoring or access control. What it does is let both sides show that their own record hasn't changed since the incident, even by someone with administrator rights.

How it would work

For ConnectWise, the thing to seal is each detection event, each access log segment and each report as it is sent. For a customer, it is their own access logs and audit trails showing which Microsoft 365 resources were reached and when.

Sealing takes a fingerprint of the log segment, not the log itself, so the logs stay where they are. If the record is questioned later, anyone with access to the log can calculate the fingerprint again and check whether it matches. Change a single character in the log and the fingerprints won't match.

A witness shows that a log segment existed at a certain time and hasn't changed. It doesn't show that the log is complete, that the response was adequate or that the detection was timely. Those are separate questions.

You can seal log segments continuously through WitniumChain's REST API, SDK or MCP server, without moving the logs themselves. The first 2,000 witnesses a month are free. Read the docs to see how it works.

What this means for you

If you rely on a third party to access your data, ask yourself:

• Do you keep your own access logs, independently of the third party's logs?
• Could you show, six months from now, which systems accessed your data on a given day?
• If your vendor's logs and yours don't match, whose record would hold up?

If you provide a service that accesses customer data, the questions are similar:

• Can you show which of your systems accessed which customer accounts, and when?
• When you detect an incident, can you prove when you first became aware of it?
• Could you hand over a checkable timeline without anyone questioning whether it was written after the fact?

Those are the evidence questions the next incident will raise.

What to watch

The Swedish Cybersecurity Act's reporting deadlines have applied since 15 January 2026 to essential and important entities across 18 sectors ^[2]. CRA's reporting rules for manufacturers apply from 11 September 2026 ^[3].

For organisations in scope, it is worth checking now whether your incident detection and logging systems can produce a timeline that would stand up to scrutiny.