ConnectWise breach exposed customers to AI-assisted intrusions
By Automate Basics, written with AI from TechCrunch's original
TechCrunch reports that attackers used AI agents to enter customer systems after stealing credentials from ConnectWise’s cloud backup service. The incident matters to businesses that use the service to back up company data.
What changed in the ConnectWise breach
TechCrunch reports that hackers broke into ConnectWise’s cloud backup service and stole credentials used to connect the service to customer systems. Microsoft researchers say those credentials let the attackers enter customers’ Microsoft-hosted environments as authorized users, with access to email and other files.
Microsoft attributes the activity to hackers aligned with the Chinese state. According to Microsoft, the attackers used AI agents to target around 2,250 organizations, reaching almost 3,000 attempted sign-ins per minute. TechCrunch identifies the AI framework as ARTEX. The reported speed matters because a large burst of access attempts can leave defenders little time to spot and respond to suspicious activity.
Who needs to pay attention, and is the backup service available?
Businesses using ConnectWise’s cloud backup service have the clearest reason to assess whether the breach affected them. The stolen credentials linked that service to corporate customers’ systems, according to Microsoft’s account in TechCrunch. A business should not assume from the reported total alone that its own email or files were accessed.
ConnectWise said it had paused access to the cloud backup system while it investigated. At the time of TechCrunch’s report, the company said it was working to restore the service. The report does not identify affected subscription plans, provide a price or say when access will return. It also does not provide a way for individual customers to confirm their status, so teams need case-specific information rather than treating the overall figures as an answer.
How do I check the risk at work?
A practical first task is to ask the team responsible for your company’s ConnectWise backup and Microsoft environment whether the affected service connects to your systems. If it does, ask them to review the relevant access activity and establish whether any sign-ins or access to email and files were unauthorized. Check that the conclusion distinguishes attempted sign-ins from confirmed access.
The reported use of AI agents is a reason to treat the review as time-sensitive, not a tool employees need to try. TechCrunch does not give customers a diagnostic procedure or say that every organization targeted had data taken. Keep the work focused on your organization’s connection to the service and evidence of access, rather than assuming the reported scale describes your company’s outcome.
Frequently asked questions
What did the attackers take from ConnectWise?
Microsoft researchers say the attackers stole application credentials from ConnectWise’s cloud backup service. Those credentials were used to link the service with customer systems and could let the attackers enter customers’ Microsoft-hosted environments as authorized users, where email and other files were accessible.
Did AI agents cause the ConnectWise breach?
TechCrunch reports that the attackers used AI agents to carry out intrusions rapidly after obtaining credentials from ConnectWise’s cloud backup service. The report identifies ARTEX as the framework involved. It does not say that AI agents were the means by which the attackers first entered ConnectWise.
Is ConnectWise cloud backup running normally?
ConnectWise said it paused access to its cloud backup system while investigating the breach and was working to restore the service at the time of the report. TechCrunch does not give a restoration date or identify which customer plans, if any, have different access.
For you
Learn to do this with AI, free
Short courses for people who aren't engineers: ChatGPT, Claude, prompting and automation. Every lesson is free, with no card.
Start a free courseFor companies
Make an AI or automation tool?
List it in the directory for $9.99, refunded in full if it isn't approved, or claim its page if it is already here.
Related reading
Meta restores Muse sharing and replaces earlier artifact linksMeta has restored Muse sharing and changed the links for artifacts shared before a reported security issue was fixed. People who sent Muse documents or images to coworkers may need to send those recipients a new link.
Google Sheets adds box and whisker charts for numeric dataGoogle has added native box and whisker charts to Sheets. People working with numeric data can now create the charts without preparing separate calculations, and exchange editable charts with Microsoft Excel.
n8n explains how to check AI agent answers before workflows continuen8n has published guidance on checking AI agent answers before they trigger later workflow steps. It describes how teams can combine answer checks, trusted sources and human review in n8n.
Written with AI from TechCrunch's original and published after automatic checks: every figure here appears in the original, and no sentence is copied from it. The picture is AI-generated. The original is the authority.
Get the next one by email
One email, most weeks: what changed in AI for people who use it at work, and what to do about it.
Source: Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise, TechCrunch, 22 Oct 2026.