Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
In Brief Posted: 9:47 AM PDT · October 22, 2026 Image Credits: Getty Images Zack Whittaker Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise The bad week for cybersecurity just got worse for thousands more companies, who were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise. Security researchers at Microsoft say the China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials that are used to establish data links between ConnectWise and its corporate customers, who rely on the cloud service to backup their company’s data. By stealing the credentials, the hackers could log in to the customer’s Microsoft-hosted environment as if they were an authorized user and access their emails and other files. According to Microsoft, the hackers used AI agents to rapidly hack into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said this speed gives defenders “little time to detect and respond.” The speed of the mass-hacks were attributed to the use of AI agents, specifically ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. The same AI software was used in a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication. ConnectWise said it’s paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service. Topics AI , connectwise , cybersecurity , data breach , Microsoft , Security November 4 Boston Buy One Pass, Get a Second Free Cover more ground at TechCrunch’s ultimate founder bootcamp of the year by bringing your co-founder or partner for free Book before the BOGO deal expires Register Now Newsletters See More Subscribe for the industry’s biggest tech news TechCrunch Daily News Every weekday and Sunday, you can get the best of TechCrunch’s coverage. TechCrunch Mobility TechCrunch Mobility is your destination for transportation news and insight. Startups Weekly Startups are the core of TechCrunch, so get our best coverage delivered weekly. StrictlyVC Provides movers and shakers with the info they need to start their day. No newsletters selected. Subscribe By submitting your email, you agree to our Terms and Privacy Notice . Related TechCrunch Disrupt 2026 TechCrunch Disrupt 2026 Startup Battlefield 200: Celebrating outstanding achievements Michael Schick Isabelle Johannessen 47 minutes ago AI Uber puts all 30,000 employees on ChatGPT Work Lucas Ropek 47 minutes ago Transportation Tesla is prepping a Cybercab onslaught Sean O’Kane 1 hour ago Latest in Security In Brief Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise Zack Whittaker 7 seconds ago Security Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack Zack Whittaker 3 hours ago Security The internet is having a very bad cybersecurity day Sarah Perez 22 hours ago