MSP contracts after the ConnectWise breach

MSP contracts are being pulled out of drawers this month. On 22 October 2026, Microsoft attributed a wave of attacks on Microsoft 365 tenants to Storm-0940, a China-aligned group (The Register). The group used stolen ConnectWise application credentials and an AI penetration-testing tool called ARTEX. It attempted sign-ins at more than 2,250 tenants. In some cases it went from picking a target to privileged cloud access in under three hours.

The uncomfortable part for buyers is that nobody at the customer had to lose a password. The attackers signed in as the backup application itself. They used permissions each tenant had already granted. So the question "did we do anything wrong?" is the wrong one. The right one is what your MSP contracts say about access, notice and who pays.

What the ConnectWise incident actually exposed

ConnectWise Cloud Backup, formerly SkyKick, is a Microsoft 365 backup tool that MSPs install inside client tenants. Sophos researchers saw an attacker authenticate as that application. It requested app-only Microsoft Graph tokens across consenting tenants from a single server over roughly 96 minutes. There was no password and no multi-factor prompt (Sophos).

The sweep included tenants with no active backup subscription. That suggests the attacker worked from a full list of organisations that had once consented. Huntress had confirmed unauthorised sign-ins in 162 tenants by 16 October. It later found close to 1,000 tenants with sign-in attempts, more than 300 of them successful (Insurance Business).

ConnectWise disabled the service and revoked certificates. It told partners to review their own and each managed customer tenant, including dormant connections (Dark Reading). It also said its findings about stored archives are separate from activity in live environments. It lacks the visibility to say whether a given tenant was touched.

The gap between accountability and control

MSPAlliance makes the structural point plainly. The provider owns the customer relationship and takes the call. But the root cause may sit with a supplier the provider never controlled (MSPAlliance). The party closest to the customer is often not the party with the greatest authority over the systems.

That mismatch is what your MSP contracts should price. Your provider may cap its liability for a supplier failure. It may still promise continuity to you. When both are true, the risk has quietly moved to your side of the table. Ask to see where that line sits.

Consolidation makes it worse. A provider that standardises on one backup platform, one remote monitoring tool and one identity stack gets efficiency. It also creates concentration risk across every client at once. A single stolen credential then reaches hundreds of unrelated businesses.

Access clauses to demand in MSP contracts before you renew

Access is where these incidents start, so it is the first clause to fix. Work through this list with your provider's technical lead in the room, not just sales.

• A named approval process for every new application consent in your Microsoft 365 tenant. Name who signs off and where the record lives.
• A register of existing enterprise applications, reviewed at least quarterly. Remove anything unused or dormant.
• A commitment to review tenants with historical connections to tools you no longer buy. Cancelling a subscription does not revoke consent.
• Detection and alerting on service principal sign-ins, not only on human logins.
• Evidence retention: sign-in and audit logs kept for an agreed period and available to you on request.

If your provider runs managed cloud environments on your behalf, the same logic applies. The managed cloud services directory lists providers by capability. That helps you compare how each one handles identity and access.

Notification clauses: who calls whom, and when

Most MSP contracts say the provider will notify you of a security incident "promptly". That word is unenforceable in practice. Replace it with hours, and say which incidents count.

Specify that notice is triggered by suspected unauthorised access to your tenant. Do not wait for confirmed data loss. ConnectWise's own statements show why. A successful sign-in does not establish that data was taken. Confirming exfiltration can take weeks or months. A provider that waits for certainty will tell you too late for your own regulatory clock.

Add a second trigger for supplier incidents. Your provider may learn about a problem upstream before it can assess your exposure. You should hear about it then. The insurance market is watching this exact question. Whether losses from one stolen credential are one event or many turns on policy wording, not on the incident (Insurance Business).

Ask for the notification to include what was checked, when, and where the evidence sits. An account manager should be able to show progress without handing you raw logs.

Liability, insurance and the limits you are buying

Read the liability cap next to the insurance clause, never on its own. A common pattern caps the provider's total liability at fees paid in the previous twelve months. It also excludes indirect losses. A backup outage that stops restores for a week may cost you far more than that cap.

Three things to negotiate:

1. 1A separate, higher cap for security incidents, or no cap for the provider's own negligence.
2. 2Confirmation that the provider carries cyber cover, with the insurer named and the certificate refreshed annually.
3. 3A clear statement of what happens when the cause sits with a supplier. Does the provider still stand behind the service? Does it pass through whatever it recovers upstream?

Watch for aggregation language in your own policy too. If several claims from one breach share a single limit, your cover may be thinner than you assumed.

Staffing and subcontractor terms

Many providers deliver through subcontractors, offshore teams or short-term engineers. When you buy IT staffing alongside managed services, the master agreement must reach those people.

Require that every engineer with administrative rights is named and background-checked. Require that they are covered by the same confidentiality and access terms. Require that subcontractors are disclosed before they touch your tenant, not after. And require that access is removed within a set number of hours when a person leaves the engagement.

It helps to know how you are buying before you argue about clauses. A comparison of fixed price, time and materials and dedicated team models explains where risk sits in each. A dedicated team model usually means more people holding credentials for longer.

The managed services knowledge hub sets out what a managed engagement should include. That gives you a checklist to test your draft against.

How to run the review in two weeks

The incident is still unfolding, so do not wait for a final report. Run a scoped review now and repeat it at renewal.

1. 1Pull every signed agreement, including statements of work and side letters. List the notice and renewal dates.
2. 2Ask your provider, in writing, which of your tenants ever consented to the affected ConnectWise applications. Include dormant ones.
3. 3Request sign-in and audit evidence for the 13 to 17 October 2026 window. Confirm whether new credentials, secrets or role assignments appeared.
4. 4Mark each clause as present, weak or missing across access, notification, liability and subcontracting.
5. 5Send a short amendment request for the gaps rather than reopening the whole agreement.
6. 6Book the same review for your other suppliers. The same credential pattern exists wherever an app holds broad permissions.

If you are choosing a provider for the first time, or adding security work to an existing relationship, browse the cybersecurity vendor directory. Ask each shortlisted firm for its own incident-notification template before you sign.

Frequently asked questions

Does a successful sign-in mean our data was stolen?

No. Microsoft has said a successful login does not establish that information was accessed. ConnectWise has said it cannot independently confirm activity in an individual tenant. Treat a successful sign-in as an exposure that needs investigation, not as proof of loss. Your provider should be able to show the token activity and any mailbox or file access that followed.

Who has to notify regulators and customers?

That depends on your sector and your own obligations, not on your provider's. If you handle regulated data, assume the clock starts when you have reason to believe access occurred. Your agreement should require the provider to give you facts fast enough to make that call. It should also require support for any notification you must issue.

Can we revoke the application consent ourselves?

Yes, and you should know how. Removing consent in your tenant cuts the access path immediately. It does not reverse changes already made inside the tenant. Review for new credentials, secrets, application registrations and role assignments made after the access began. Then follow the vendor's remediation guidance.

Should we stop using third-party backup tools?

Not necessarily. The lesson is about permission scope and oversight, not about avoiding SaaS backup. Ask for least-privilege permissions, alerting on service principal sign-ins, and a contractual right to audit. A tool you can see and revoke is safer than one you inherited and forgot.

What this means for buyers

Start with the tenants, not the paperwork. Get a written list of every application your provider has consented to in your environments. Mark the ones you no longer use, and decide which stay. Then send one short amendment covering named access approval, a notice window in hours, evidence on request, a security-specific liability cap, and disclosure of subcontractors.

Set a diary entry to repeat the review at every renewal. Ask for the provider's own incident playbook before you need it. If the answers are vague, that is useful information while you still have time to change suppliers. Post the requirement as a project and compare responses on the clauses, not on the sales deck. Describe your project and see how each vendor handles access and notification in writing.