Stolen ConnectWise API Secret Exposes Microsoft 365 Environments Across Thousands of Organizations

What happened

Attackers obtained a ConnectWise API secret and leveraged the integration with Microsoft 365 to enumerate mailboxes, read emails, and download files across many tenant environments. The activity went unnoticed because standard alerts did not flag third‑party credential misuse.

Why it matters for trust and compliance

• This incident illustrates why a continuous third‑party risk‑management program must capture, monitor, and evidence the lifecycle of vendor credentials, satisfying a core control objective that maps across NIST CSF 2.0, ISO 27001, and other frameworks.
• Provides a concrete data point for continuous monitoring of vendor credential usage.
• Supports audit‑ready evidence that vendor access is limited to least‑privilege scopes and revoked on anomaly.

Who is affected

Recommended actions

1. Catalog all third‑party API secrets and enforce least‑privilege permissions.
2. Deploy real‑time monitoring of vendor credential activity with automated alerting and revocation.
3. Document credential‑lifecycle controls as evidence for audit readiness.