Cybersecurity Watch · October 21, 2026
A Compromised Backup App Credential Reaches Microsoft 365 Tenants, Ahold Delhaize's Outage Reaches the Supermarket Shelf, and a Record Patch Tuesday Hides One Exploited Bug That Matters Most
The Most Consequential Security Risk This Week Is a Trusted Third-Party Identity, Not a Zero-Day
ConnectWise has suspended Cloud Backup, SaaS Security and Cloud Management after unknown attackers used a compromised credential belonging to its Cloud Backup application (formerly SkyKick) to sign in to customers' Microsoft 365 tenants. The credential belongs to the application, so the attacker inherited whatever permissions customers had granted it. For security teams, the lesson is immediate: a vendor's application identity is a privileged access path into your tenant, and disabling it does not tell you what happened inside.
Ahold Delhaize shows the other end of the impact scale: a cybersecurity incident that began in mid-October forced it to take systems offline across Europe and the US, left Albert Heijn without online deliveries for at least 11 days, and was reported to Dutch police on October 19, though the company says it has found no evidence that customer data was stolen. And October's record Patch Tuesday contains one actively exploited Windows Shell flaw, CVE-2026-96951, that deserves priority over the sheer volume of fixes.
Verification note: The reporting does not establish that the ConnectWise and Ahold Delhaize incidents are related. The Dutch National Cyber Security Centre said there was no reason to believe the incident in the Netherlands was directly linked to attacks in other countries, and neither company has said customer data was stolen. Each item below separates confirmed facts from open questions and states its original date.
Cybersecurity Watch at a Glance
| Development | Dates | Status |
|---|---|---|
| ConnectWise Cloud Backup / Microsoft 365 tenant compromise | Oct 17 to 20 | Confirmed by ConnectWise and Microsoft; investigation ongoing |
| Ahold Delhaize cybersecurity incident | Oct 12 to 19 | Confirmed incident; police report filed; no evidence of customer data theft so far |
| October Patch Tuesday, CVE-2026-96951 | Oct 13 | Patch available; exploited; in CISA KEV; older story still active |
| Third-party application identity as a security boundary | Oct 17 to 20 | Analysis built on the ConnectWise incident |
Cyber Incidents and Service Disruption
ConnectWise Suspends Cloud Backup After Attackers Use Its Application Identities Against Microsoft 365 Tenants
What happened (October 17 to 20, confirmed): ConnectWise said it disabled seven application identities on October 17 and revoked the certificates behind affected connections, invalidating the shared Cloud Backup credentials, per The Hacker News. The disabled identities cover Cloud Backup and Cloud Management integrations for Teams, Exchange Online, Microsoft Graph, Partner Center and SharePoint Online, per Techzine. Cloud Backup, SaaS Security and Cloud Management remained suspended as of October 19, with SaaS Security and Cloud Management suspended as a precaution because they are integrated with Cloud Backup.
What Microsoft and researchers say: Microsoft said on X that it is tracking an active supply chain attack in which a threat actor compromised the OAuth app for ConnectWise Cloud Backup to obtain access tokens across customer tenants, per The Hacker News, which also reported researcher findings of unauthorized sign-ins across 173 tenants. Other outlets cite different tenant counts, so treat the figure as a researcher estimate. BleepingComputer reports that Huntress identified the legitimate Cloud Backup application ID used in the attacks, and that ConnectWise has no indicators so far that partner backup data was compromised.
Latest update (October 19 statement, reported October 20): ConnectWise said it has strengthened administrative-access protections, reset accounts, replaced application credentials, engaged independent specialists and published remediation guidance for partners. It said it has seen no successful threat activity in the environments it monitors and no evidence that other ConnectWise products are affected, and it stressed that this does not establish whether individual partner or customer tenants were affected. Huntress reported post-compromise activity in two tenants in which the application granted itself Global Administrator and then added new secrets to a small number of other applications for persistence. The access may have been used for Microsoft Graph directory reads, with no signs so far of mailbox, file, user or policy manipulation. It is not yet known whether a product vulnerability contributed, and ConnectWise has not disclosed how the credential was obtained.
Why it matters: A backup tool holds broad, trusted access by design. Compromise one vendor credential and an attacker inherits that access in every tenant that granted it. MSPs and direct customers both need to review their own tenants, because the vendor's containment does not substitute for a tenant-level investigation.
Connect to: Company Intelligence · Cloud Computing Watch · Technology Intelligence
Ahold Delhaize Reports a Cybersecurity Incident to Police as Online Services Recover
What happened (disclosed October 12, update October 19, confirmed): Ahold Delhaize's October 19 update says it notified the Dutch National Cyber Security Centre within 24 hours of discovering the malicious activity and filed a formal police report on October 19. Taking systems offline was a precaution that affected most of its brands across Europe and the US. Reuters reports that Albert Heijn's online deliveries were suspended for at least 11 days, that online accounts account for about 10% of Albert Heijn sales, and that the company has said there is no evidence customer data was stolen.
Recovery status: Albert Heijn's website and app are back online, with home deliveries expected to resume on October 23; Belgian e-commerce is fully operational, and US e-commerce is expected back in the coming days. Physical supermarkets stayed open. Earlier reports said the shutdown also hit systems behind the BONUS loyalty program, and NL Times reported that police said no investigation had started because no report had yet been filed. That has now changed.
What is not known: The company has not said who is responsible, how the intruders got in, or whether ransomware was involved. Retail experts quoted by RTL Z, per NL Times, estimate lost Albert Heijn revenue of €120 million to €150 million. That is an outside estimate, not a company figure.
Why it matters: Operational impact does not require data theft. Shutting down systems as a precaution cut off online sales, supply and loyalty functions across several brands. For retail and logistics leaders, the question is how long the business can run with e-commerce, customer apps and supply-chain integrations offline, and how quickly each can be restored independently.
Connect to: Company Intelligence · The Newsroom
Vulnerability and Patch Intelligence
Record October Patch Tuesday Includes an Exploited Windows Shell Bypass
What happened (October 13; earlier story still active): Microsoft's October 13 release was a record. SecurityWeek counted 1,413 CVEs, including 1,102 affecting Windows, 134 in Office, 61 in developer tools and 36 in SharePoint Server. Counts differ across outlets, from 1,407 to 1,413, because they treat republished and cloud-side entries differently. Only one is confirmed as exploited: CVE-2026-96951, a Windows Shell security feature bypass (CVSS 8.8) that lets crafted files evade Mark of the Web, the tag Windows applies to internet downloads so SmartScreen and Office Protected View can warn users. BleepingComputer notes Microsoft has shared no details on how it was exploited. CISA added it to its Known Exploited Vulnerabilities catalog on October 13 with a federal remediation deadline of October 16, which has now passed. Two other zero-days were publicly disclosed but not known to be exploited, in the .NET Framework (CVE-2026-108398) and the MessagePack-CSharp library (CVE-2026-92707).
Other items worth checking, per Computerworld's analysis: a SharePoint Server flaw, CVE-2026-65660, fixed in August, was revised on September 25 to say Microsoft has reliable evidence of attacks, and CISA added it to KEV, yet the Security Update Guide still shows "Exploited: No," so reports filtered on that flag would miss it. An Exchange Server flaw, CVE-2026-96940, published on October 2, has its own updates separate from the October 13 set, so confirm both are installed. Windows Server 2012 and 2012 R2 Extended Security Updates ended with this release.
Why it matters: The volume of fixes is not a measure of risk. One exploited flaw in a component present on every Windows endpoint is the priority, and one researcher quoted by Shattered notes that CVSS alone would have ranked a 9.3 flaw above this 8.8 one even though only the latter is exploited. Mark of the Web bypasses matter because they let a malicious file launch without the usual warning, typically after a user opens a file or link.
Connect to: Cybersecurity Watch · Company Intelligence
Cloud and Identity Security
Third-Party Application Identity Becomes a Critical Security Boundary
The mechanism: When a service such as a backup tool is connected to a customer's Microsoft 365, Microsoft issues it an application identity with specific permissions, which is how it can read mailboxes or SharePoint data. If the vendor's credential for that identity is stolen, the attacker signs in as the application, not as a user. SpecterOps' analysis notes the attacker inherits the permissions granted to the app and says the credential's theft method has not been disclosed.
Why revoking is only step one: ConnectWise disabled the affected identities, and its own statements stress that this does not establish what happened in individual tenants. Huntress's finding of apps granting themselves Global Administrator and planting new secrets in other apps shows why: attackers can create persistence that survives the original connection being cut. Techzine reports that ConnectWise says MSPs must independently review their own tenants and those they manage.
Controls to know: The Hacker News notes that Conditional Access for workload identities, which needs additional licensing, can restrict where an application is allowed to sign in from, and that Microsoft Entra ID Protection can flag risky service principals.
The AI angle: Non-human identities are multiplying as organizations deploy AI agents. Microsoft's October 19 announcement of agent controls extends Entra Agent ID and conditional access to agents, per SiliconANGLE. The same audit discipline applies to agents as to backup apps: know which identities exist, what they can do, and who owns them.
Connect to: Enterprise AI Intelligence · Technology Intelligence
Enterprise Response Priorities
- Determine ConnectWise exposure. If you or your MSP use ConnectWise Cloud Backup, SaaS Security, or Cloud Management, ask in writing which of the disabled identities were connected and review each tenant. Preserve evidence before changing anything, and do not reconnect affected applications until ConnectWise provides formal restoration instructions.
- Hunt in Entra. Check service principal sign-ins for the Cloud Backup application ID, look for unexpected source addresses, and review recent changes to app registrations, secrets, permissions, and administrator roles. Huntress has published IP addresses it observed.
- Audit all third-party app permissions. List which vendors hold tenant-wide permissions such as directory write access, and remove any that are unused or broader than needed.
- Make backups independent. A backup that shares its identity path with the system it protects is not independent. Confirm you can restore without the compromised connection.
- Patch CVE-2026-96951 first. Prioritize Windows endpoints, starting with users who handle the most external email and downloads, then confirm SmartScreen and Protected View warnings still appear. Confirm the SharePoint August update and both Exchange update sets are installed, and plan for Windows Server 2012 systems that no longer receive updates.
- Rehearse an operational outage. The Ahold Delhaize case shows precautionary shutdowns can last days. Decide in advance which online and supply-chain functions you would take offline, who authorizes it, and how each is restored.
What to Watch Next
- ConnectWise restoration and root cause. Formal restoration instructions, how the credential was obtained, whether a product vulnerability contributed, and any further advisories from ConnectWise, Microsoft, or Huntress.
- Tenant impact numbers. Reconciled counts of affected tenants and any evidence beyond directory reads.
- Ahold Delhaize recovery. Albert Heijn home deliveries expected from October 23, US e-commerce restoration, and any attribution, entry point, or data-impact finding from the police and NCSC investigation.
- Patching signals. Evidence of wider exploitation of CVE-2026-96951 and Microsoft's next Patch Tuesday on November 10.
- Related active exploitation. Continued exploitation of the BeyondTrust Remote Support flaw covered in The Newsroom, where patching does not undo earlier compromise.
Compromising a service provider's application identities can create access across many customer tenants, and closing that connection does not tell you what the attacker did inside.
For security teams: Treat vendor application identities as privileged accounts. Inventory them, limit their permissions, and monitor their sign-ins.
For IT and business leaders: Plan for operational disruption without data theft. Precautionary shutdowns have real revenue and supply-chain costs.
For patch managers: Triage by exploitation evidence, not volume. One confirmed exploited flaw outweighs a thousand unexploited ones.
The CODEW Stat
1 exploited flaw among roughly 1,400 — Microsoft's October release was the largest on record, yet only CVE-2026-96951 is confirmed as exploited. The headline number is a workload measure, not a risk measure. Meanwhile, the incident with the widest reach this week, ConnectWise, involved no new vulnerability that is publicly known, only a credential. The attack surface that matters most is increasingly the set of identities with standing access to your environment.
Sources: ConnectWise advisories as reported, Microsoft statements as reported, Huntress and SpecterOps analysis, The Hacker News, BleepingComputer, Help Net Security, Techzine, Ahold Delhaize's company update, Reuters, NL Times, SecurityWeek, Computerworld, CISA KEV information as reported, and SiliconANGLE, covering October 12 to 21, 2026. Where a story is relayed through a secondary outlet, the item says so.
Confirmed incidents, ongoing investigations, and outside estimates are labeled separately. The reporting does not establish that the incidents are related or that customer data was stolen in either case. Verify indicators, application IDs and patch details against vendor advisories before acting. This series does not provide security or investment advice.
Reviewed by Erwin Castro
on
Wednesday, October 21, 2026
Rating:
No comments: