# Credential Compromise Exposes 173 Microsoft 365 Tenants

A compromised ConnectWise service-account credential enabled unauthorized access to 173 Microsoft 365 tenants beginning October 13, 2026, through delegated administrator privileges and legitimate Microsoft tools. No malware or specific threat actor was identified. For government contractors and other organizations that rely on managed service providers, the incident underscores how third-party administrative access can create supply-chain risk across customer environments.

- Contractors using managed service providers should review delegated access, enforce multifactor authentication and least privilege, rotate service-account credentials, and audit Microsoft 365 activity.
- Procurement and vendor-risk teams can use the incident to assess how providers secure service accounts and administer customer tenants.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 18, 2026

### Vendors
- ConnectWise (Service provider associated with the compromised service-account credential)
- Microsoft (Provider of Microsoft 365, the affected platform)
- Rescana (TPRM platform provider and advisory source)

### Sources
- [ConnectWise Credential Compromise Enables Unauthorized Access to 173 Microsoft 365 Tenants: Cybersecurity Incident Analysis – Rescana](https://www.rescana.com/post/connectwise-credential-compromise-enables-unauthorized-access-to-173-microsoft-365-tenants-cybersecurity-incident-analys) - Rescana