GoKawiilConnectWise breach lets China-linked hackers access data at 2,250 firms
Microsoft says China state-aligned hackers breached ConnectWise's cloud backup service and stole application credentials used to link ConnectWise with corporate customers' Microsoft-hosted environments. Using AI agents to automate sign-in attempts at nearly 3,000 per minute, the attackers gained access to roughly 2,250 organizations' emails and files. ConnectWise has paused access to the affected backup system and is investigating while working to restore service.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how AI-driven automation can compress what used to be slow, detectable intrusion campaigns into minutes, leaving defenders little warning, according to Microsoft. It also highlights how a breach at a single IT-management vendor can cascade into exposure for thousands of downstream customers who trusted that vendor's credentials. The same AI tooling was reportedly used in a prior breach of South Korean financial systems, suggesting this approach to mass credential abuse may be spreading among state-linked hacking groups.
- Microsoft attributes the breach to China state-aligned hackers who stole ConnectWise cloud-backup credentials.
- AI agents reportedly enabled sign-in attempts at nearly 3,000 per minute across about 2,250 organizations.
- ConnectWise has suspended the affected cloud backup service and is investigating while restoring access.
YubiKey 5C NFC Security Key — With credential theft and AI-accelerated sign-in attacks like the ConnectWise breach on the rise, hardware-based multi-factor authentication is one of the strongest defenses against stolen application credentials being used to impersonate authorized users. A YubiKey adds a physical security layer that can't be phished or replicated remotely, making it a smart investment for IT admins and businesses managing sensitive cloud access.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: techcrunch.com — Zack Whittaker, 2026-10-22
Published there as: “Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.