What happened
On October 17, 2026, ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after discovering that attackers had compromised application identities within its environment. By leveraging these stolen credentials, threat actors gained unauthorized access to over 160 Microsoft 365 tenants, in some cases assigning themselves administrative roles to maintain persistence and add new credentials.
Why this matters
This incident demonstrates the extreme risk of supply-chain dependencies in cloud environments. Because ConnectWise applications held high-level permissions within customer tenants, a single breach at the vendor level allowed attackers to bypass individual customer security controls. This creates a 'force multiplier' effect where one compromised vendor credential can lead to the simultaneous breach of hundreds of downstream organizations.
How zero-knowledge changes this
SecureIDsafe’s architecture is designed to mitigate the impact of such supply-chain compromises. By utilizing client-side encryption, all data is encrypted on the user's device before it is transmitted to any cloud service. Because SecureIDsafe never holds the encryption keys—which are derived locally from the user's device—the provider stores only indecipherable ciphertext. Even if an attacker were to gain administrative access to the storage infrastructure or the application identities, they would find only encrypted blobs that are mathematically impossible to decrypt without the user's unique, non-bypassable 24-word BIP-39 seed. In this scenario, the customer data would remain private and secure, as the provider would have no access to the plaintext data to lose or expose.