China-linked hackers exploited ConnectWise flaw to spy on thousands of firms
What happened
On 23 October 2026, TechCrunch reported, citing Microsoft security researchers, that China-linked state hackers breached the cloud backup service of IT management and remote access vendor ConnectWise, stealing application credentials used to link customer data and then logging in as authorised users to customer environments hosted on Microsoft to read email and other files, affecting thousands of firms. The report said the attackers also used AI agents in the intrusion. Microsoft and ConnectWise have not yet published a full list of affected organisations, and the incident is still developing.
Written by AI from the reports · updated 3 h ago
Timeline
Follow the reports to see the event from each side.
- TechCrunch · AIChinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
Heat of this event
Current heat 5·Peak in the comparable range 5（Oct 23 23:00）·Change over 24 hours in the comparable range –
The trend compares only the same accounts observed without a break, so its range can be narrower than the current heat count. Move the pointer or tap the chart to see each hour; with a keyboard, use the left and right arrow keys.