The ConnectWise supply-chain attack is a sharp reminder that your business doesn't have to be the primary target to end up compromised. In this incident, attackers exploited vulnerabilities in ConnectWise ScreenConnect — software that thousands of managed service providers (MSPs) use to remotely support their clients — to work their way into Microsoft 365 tenants belonging to small and medium businesses. If your IT support company uses ConnectWise, and many do, your accounts and data may have been in the blast radius without you ever knowing.
How a Trusted Tool Became the Attack Vector
Supply-chain attacks work by targeting a vendor or software provider that has privileged access to many organisations at once. Rather than breaking into each business individually, the attacker compromises one well-placed tool and effectively gets a master key. ConnectWise ScreenConnect is exactly that kind of tool — it sits on machines with elevated permissions, allowing technicians to take control of systems remotely to fix problems.
In this attack, threat actors exploited known vulnerabilities in ScreenConnect to gain unauthorised access. From there, they pivoted into Microsoft 365 environments, which meant they could access emails, SharePoint files, Teams conversations, and potentially stored credentials. For a small business, a breached Microsoft 365 account isn't just a data problem — it's a potential gateway to invoices, client records, payroll data, and internal communications.
Why SMBs Are Disproportionately Exposed
Large enterprises often have the resources to run independent security audits on every third-party tool in their stack. Most SMBs cannot. You rely on your MSP or IT provider to keep things secure, and in most cases, that trust is reasonable. But when the provider's own tooling is compromised, that trust becomes the vulnerability.
This matters because most SMB owners won't receive a direct notification when something like this happens. Patches get applied quietly. Advisories go out to technical audiences. The business owner finds out weeks later, if at all — and sometimes only after credentials have already been harvested and sold on dark web markets.
Breachrr exists precisely for this gap. We continuously monitor breach databases, infostealer logs, dark web forums, and leaked credential dumps for signs that your business accounts or employee data have been exposed. When attackers pull credentials from a compromised Microsoft 365 environment, those credentials often surface in dark web markets or paste sites within days. Catching that early is the difference between a managed incident and a full breach response.
What You Should Be Doing Right Now
If your IT provider uses ConnectWise ScreenConnect, the first step is asking them directly whether they have applied the relevant patches and whether any of their client environments — including yours — showed signs of suspicious access during the affected window. A good provider will answer this clearly.
Beyond that conversation, there are practical steps worth taking. Review your Microsoft 365 sign-in logs for any logins from unfamiliar locations or devices. Enable multi-factor authentication on every account if you haven't already — this won't stop every attack, but it significantly raises the bar. Check whether any accounts with administrative permissions were accessed during the period in question.
It's also worth auditing what third-party tools currently have access to your Microsoft 365 environment. Many businesses accumulate connected apps over time without realising the permissions they've been granted. Revoking access from anything unused is a simple but effective step.
The Bigger Picture on Supply-Chain Risk
The ConnectWise supply-chain attack is not an isolated event. Over the past few years, attackers have repeatedly demonstrated that targeting trusted software providers is a highly efficient strategy. The 2020 SolarWinds attack, the Kaseya ransomware incident, and now incidents like this one all follow the same logic: compromise the tool, inherit the access.
For SMBs, the lesson is that cybersecurity can't be fully outsourced. You don't need to become a security expert, but you do need visibility into whether your business has been affected when these incidents occur. Waiting for your IT provider to tell you isn't enough.
Understanding your exposure starts with knowing what's already out there. Run a free audit at breachrr.com/audit to see whether your business credentials, domains, or employee data have already surfaced in breach databases or dark web markets — before someone else finds them first.
Want to see if your company is exposed?