{
  "type": "bundle",
  "id": "bundle--519803e7-2adb-56ee-860e-54738f9e6041",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--d32b24b1-d3da-5d42-8d62-336ac11a54e9",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "org:6e776a45-c49a-4924-8b0c-4e6837115bfe",
      "name": "ConnectWise",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--7c768c85-a687-5fbe-893d-68d316115e56",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "inc:878a7fac-85a9-4c02-a11d-08018b33cbe1",
      "name": "ConnectWise Cloud Services application-identity compromise"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--f2640b55-e5ae-56cd-8f2c-8c1d794e2981",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "brh:347b1f72-f1a7-4024-ba65-40e14899e998",
      "name": "ConnectWise Cloud Services application-identity compromise"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18d9d79b-20c8-5d19-8f17-8428c0d67e2b",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:4ad88da8-cabe-4110-98d3-fe6c41024faf",
      "relationship_type": "affected-organization",
      "source_ref": "incident--7c768c85-a687-5fbe-893d-68d316115e56",
      "target_ref": "identity--d32b24b1-d3da-5d42-8d62-336ac11a54e9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:fabfaea0-f0e2-4f99-a0cf-8f4d3c53acea",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2778d769-b2ac-5689-8fa8-7e53e688a6a8",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:639ea8e8-2d7d-46dc-aa1f-a5e869fcffb0",
      "relationship_type": "resulted-in",
      "source_ref": "incident--7c768c85-a687-5fbe-893d-68d316115e56",
      "target_ref": "x-ally-event--ed3ef718-7e73-556e-89ca-595ccec63e90",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:b3eab691-bc9f-49c3-b9bb-614be3af5a25",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30fdd6c5-3903-5b66-8b1e-e7c590cd8d5c",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:64cc7bf5-c778-4a8a-be77-e4c7a838da46",
      "relationship_type": "resulted-in",
      "source_ref": "incident--7c768c85-a687-5fbe-893d-68d316115e56",
      "target_ref": "x-ally-event--4337a61c-6587-5724-8a65-c984c1aee5c8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:5cf823e0-e854-4e0a-9644-59c3977995cd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4ee7038-b5e5-53a6-810e-3daa281557c2",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:3debcfb2-f9cd-41f9-9ead-24ecad4b90d3",
      "relationship_type": "resulted-in",
      "source_ref": "incident--7c768c85-a687-5fbe-893d-68d316115e56",
      "target_ref": "x-ally-event--165eaa36-7728-530b-85e1-b4e393d68f72",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:fd9835b1-2a26-4089-b094-4b12c6dd3576",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c17e34e2-8bd8-54db-8f48-0c6260b5d150",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:025ef962-5b1b-40c4-9c04-932927305bfc",
      "relationship_type": "used-product",
      "source_ref": "incident--7c768c85-a687-5fbe-893d-68d316115e56",
      "target_ref": "software--9a1967a1-4707-59fe-88b4-adb78ec69a3c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:a3ea204d-5d7b-4f95-81a5-844668db36fb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dce85782-8921-5b31-877b-a04306e39ed0",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:585248bf-0d76-43bf-ae6e-8f06c238b472",
      "relationship_type": "resulted-in",
      "source_ref": "incident--7c768c85-a687-5fbe-893d-68d316115e56",
      "target_ref": "x-ally-event--3c233124-097e-5c45-8846-7598173554a5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:6f9711c1-8a6a-486d-b187-c7679336b0a6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3781e68-0bc0-5488-88bb-5f581467d2e2",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:e7e22bd2-b70b-468f-b05d-aaffc4831c13",
      "relationship_type": "resulted-in",
      "source_ref": "incident--7c768c85-a687-5fbe-893d-68d316115e56",
      "target_ref": "x-ally-event--43f4c5b7-5ddf-53e2-80b2-b76d99d6df17",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "external_id": "cit:c1c4a46d-e604-4a2d-8103-2dc314807ea3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6de62ce2b8b3a9baed040ac94594a2a75cabadca131bcf96559ca8f4a67fc5fb"
        }
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--9a1967a1-4707-59fe-88b4-adb78ec69a3c",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "prd:a02af06e-cee6-4b50-bc68-382d04e7381b",
      "name": "ConnectWise Cloud Backup"
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--115cc6b8-af00-5d8b-8ccb-185e8bfee36f",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:81e03dac-164c-4655-b759-951dfbe2c8d9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:6d85cbfd-a347-4ec9-bd2d-c479e77f588a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-16"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--11e7e4b6-f313-5eb8-8167-f4a540190b94",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:b99fdb85-4aec-4877-8b18-1658471bc57d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "external_id": "cit:e3caaa3b-9f41-4351-9745-a8ce71dd0577",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6de62ce2b8b3a9baed040ac94594a2a75cabadca131bcf96559ca8f4a67fc5fb"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Huntress observed successful authentication using the compromised vendor application identity."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1af7121a-06f0-53a1-8aee-8c19e033f7bb",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:089cacbd-0e07-4f85-a81f-8cd3c4782c58",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "external_id": "cit:7652397d-2169-4ada-b113-cccd54ac00f4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6de62ce2b8b3a9baed040ac94594a2a75cabadca131bcf96559ca8f4a67fc5fb"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "In its October 17 5:15 PM ET update, Huntress reported sign-in activity from the associated address in almost 1,000 Entra tenants, with more than 300 successful sign-ins; these observations are not an affected-person or data-theft total."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--22387902-8837-5b96-8449-b8f4eee71818",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:2f77d816-1dce-4c00-91a0-6b087df364c3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:b1cf0576-a505-454d-a6f6-a1d450855658",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-18"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--22b63b5a-6d10-5c82-8d3e-8362a8dcb810",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:c108f062-33fe-4ddc-9c99-a6e56e19854e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:31445536-22c7-460b-ae12-9be7cd61aa3e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise temporarily took SaaS Security and Cloud Management offline as a precaution, interrupting monitoring, alerting, and user and license management."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2f38e387-7890-5add-88de-f8d203d2a6e4",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:3f78a124-2691-4a74-a23a-43494163a580",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:61033a7b-0dea-48d8-83c6-227fac8dd625",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise engaged an external forensic firm and said investigation and validation remained ongoing."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--383f4740-9ae2-502a-87b3-5ccff7f2a3fe",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:9efc5bde-4336-4100-ad5b-4cd0ae3cd607",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "external_id": "cit:e6f5c02d-4060-461e-9ab1-bd95a4a5b16b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6de62ce2b8b3a9baed040ac94594a2a75cabadca131bcf96559ca8f4a67fc5fb"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Huntress confirmed that a compromised ConnectWise Cloud Backup application credential was used to authenticate to customer Microsoft 365 tenants on October 15, 2026."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3f29135a-7b1a-5493-813c-52122017fdaf",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:50457c89-9715-4603-9d35-c61ffd420206",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:1057534f-a7c8-4865-bad3-dc92d0322985",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise warned that issued access tokens could remain usable until expiry or invalidation and that disabling the original applications did not remove separate unauthorized credentials or permissions inside customer tenants."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3f744f96-2a7c-5629-8738-c78fd76afa7f",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:e005b5ed-0d76-4239-a6d3-3d29c1378410",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:3ebc8450-9c3b-4f29-a494-df4562ff8b2a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise first published the advisory at 17:47 UTC."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--41d1cee6-6df0-57c9-89ab-3864c54780e1",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:c3ca8eda-6127-4f75-a5c7-a84c3f03d358",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:a6b8b131-8ded-411f-9dd2-a5843363d1b5",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise confirmed unauthorized access to application identities associated with Cloud Backup, formerly SkyKick."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4a969a34-940e-5877-8ee2-22b651aef9a8",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:96247205-5914-4fe1-bbec-4e41aa5546a1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:89d95eca-f734-4b2f-8ef5-6315a35138bb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-16"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4bb6fe25-fc0d-52d6-86dc-8737b8c9db95",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:fd630973-6145-46ee-a8b7-33812d06fd39",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:5ca408e8-669e-4ee9-9a19-62d142fab8fb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--562de424-9af9-5176-81b9-07f6e6895363",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:252f5572-bae5-4dca-95ce-497f09028234",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "external_id": "cit:8d6b3ef5-7814-4841-8ac5-ea3d0b54869c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6de62ce2b8b3a9baed040ac94594a2a75cabadca131bcf96559ca8f4a67fc5fb"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Huntress said the private Azure address associated with the credential-addition activity did not identify the operator; it had not tied that activity to the same operator as the public-address authentication activity."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--63667edf-297d-50d3-82a9-9aaaee79e57b",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:ec555928-6566-47fb-8fe6-0a4ce406885a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:b953db14-5598-443a-a3fe-771d007506d1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "As of the October 18 update, scheduled backups, access to affected backup archives and restoration capabilities were unavailable; ConnectWise had not provided a restoration time."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--664ca28b-4d2d-5e12-8f88-5e76bafa1ee5",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:f4df8b8b-8e21-4a77-a7a0-c869632dcae0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "external_id": "cit:da36a4cf-db09-4373-a4d4-c25b85ded395",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6de62ce2b8b3a9baed040ac94594a2a75cabadca131bcf96559ca8f4a67fc5fb"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Huntress observed a ConnectWise Cloud Management application assign itself Global Administrator and add credentials to two other applications in one customer tenant on October 15."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7a90bd16-26d2-5191-8d81-71b772f8d9ec",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:11ef4323-4208-48fd-b31c-32ff6db5608f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:18611d56-b713-4f49-9949-ab0c5ed61d3b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The vendor reported continued Cloud Backup suspension and precautionary SaaS Security and Cloud Management pauses."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8762d24d-d754-55b8-89f9-d6b4a204bc85",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:a77b63ea-03d4-4568-a40d-78ad1af7cfeb",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "external_id": "cit:fe4a8d14-9849-4747-b38c-d7ad12c60f00",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6de62ce2b8b3a9baed040ac94594a2a75cabadca131bcf96559ca8f4a67fc5fb"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-15"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8e84f5b9-4737-52e1-8a99-b6fbf886358a",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:58617fda-d455-448d-b944-11da3e24e207",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Todyl",
          "url": "https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app",
          "external_id": "cit:0aeb7a6f-3b27-4190-9ed0-333f358e5288",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f6da3e6be6af0e34699e72b12036a5f2fa724767eca3a62da0a9294068a48023"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Todyl independently observed successful application-only authentication on October 15 and analyzed nine affected tenants without active backup subscriptions."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9594bc8f-6197-5ca2-8833-ac67ef4725a8",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:f2e5e390-5e33-4b86-8e20-5737e989c9d3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Todyl",
          "url": "https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app",
          "external_id": "cit:a48cfe0f-acaf-4e4b-bb95-9be2c8152145",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f6da3e6be6af0e34699e72b12036a5f2fa724767eca3a62da0a9294068a48023"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Todyl found no persistence or configuration changes in its nine-tenant analysis."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9c0f37d0-739a-58be-8992-4c1ea679e070",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:f0d0b372-5fb7-4fd4-b2b7-c8f10c313dcc",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:0e64656c-40d0-4ae9-a757-e6f69b73e5d3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise disabled seven application identities at 07:00 UTC on October 17 and revoked certificates used for affected connections to suspend Cloud Backup."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a49d68c2-301c-5fbe-8c35-6d7550bc817e",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:a38e0444-ef51-4084-8559-05d6cd8d8009",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access",
          "external_id": "cit:8d25fd56-1024-4ff3-93ec-f9587219275a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6de62ce2b8b3a9baed040ac94594a2a75cabadca131bcf96559ca8f4a67fc5fb"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Huntress removed the unauthorized credential from its single-tenant application on October 16 after it had been used for seven sign-ins."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a4ffadb8-081e-5fed-8ec5-bda481a09bac",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:c61fad3c-1f21-4a8c-a717-0cd7712a7acd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:7d0de424-aabd-48cb-b965-6aacf3b46fab",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-17"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b1ece7d3-5f05-5177-8ea4-5293decc047c",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:2fd7eed1-3e52-4c14-9c5f-d4428b9bc8b0",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1078/004/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bbad2349-237d-5983-8214-eb8b7029fa6d",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:9c99b2de-c648-437e-8cdd-4bb023613b25",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:243ca224-f0be-49c9-8786-59360eef97a0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise dates its identification of the issue to October 14."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c44e1a10-1c9b-5db4-89b0-f09c4519452b",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:4d48f8ee-cfa4-40c8-b3b3-a39b5bf4fca7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:3189fc8d-2fb4-4e7f-9416-d168a6aca135",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise said existing backup archives remained encrypted, isolated and preserved, with no evidence that those archives had been accessed; this assessment is separate from activity in live Microsoft 365 tenants."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c72c7742-57fa-5a3f-8891-8f78cc91c0f7",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:72c8ad1a-15ed-4c7f-a1c8-a2b80bf3a35f",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1098/001/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cc4711ad-b3ad-5310-8e61-b74396b51492",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:320daabb-279f-47e2-82f7-d63961c03cc2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Todyl",
          "url": "https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app",
          "external_id": "cit:14c1159c-ca8d-4942-8f98-3d4593d60da6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f6da3e6be6af0e34699e72b12036a5f2fa724767eca3a62da0a9294068a48023"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Todyl reported that it could not reliably distinguish malicious read activity from normal backup activity for active subscriptions without historical Graph request-source logs."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cedcdb91-7b48-5440-8b0f-a6a12477cc63",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:2ba73c7c-27a4-4cc4-9351-3b7df2c510f9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:0e5fac22-8cef-4a9a-9794-6c00ccb75360",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise disabled seven application identities at 07:00 UTC."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--dc76a91e-c402-5686-81ff-9ff6b24288df",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "clm:b38f9cf7-2ce8-4914-a657-c577e7ab03da",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:49b51441-81ae-4cb8-9237-b50f4dc3f304",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d78ce9eb41d46d6c1bfbc5912a9a5525ceae057d880234c3c828a52addfca271"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-14"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--165eaa36-7728-530b-85e1-b4e393d68f72",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "evt:76ad8918-a20f-4fac-8714-75e21438804f",
      "name": "Vendor identified the issue"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--3c233124-097e-5c45-8846-7598173554a5",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "evt:23d884ed-a9b9-4fc9-8491-c8d204b8ad1b",
      "name": "Vendor advisory published"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--4337a61c-6587-5724-8a65-c984c1aee5c8",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "evt:3a95ce80-8098-4e2d-93be-6a6797bf217c",
      "name": "Expanded service interruption reported"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--43f4c5b7-5ddf-53e2-80b2-b76d99d6df17",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "evt:be931889-2e06-432e-b7d1-7d3c2fe62c17",
      "name": "Unauthorized customer-tenant authentication"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--ed3ef718-7e73-556e-89ca-595ccec63e90",
      "created": "2026-10-18T14:05:23.601083+00:00",
      "modified": "2026-10-18T14:05:23.601083+00:00",
      "x_ally_original_id": "evt:b0cfdb73-5253-4c24-ac24-bf6a13412b3f",
      "name": "Application identities disabled"
    }
  ]
}