Contained Tenant Breach

Microsoft and ConnectWise move quickly to revoke tokens, publish indicators of compromise, and confirm that the attacker’s access was limited to the already identified tenants. This is the most likely path because the reported scope is specific and there is recent precedent for Microsoft-led takedowns and coordinated remediation.

Each figure is the modeled move of the S&P 500 if the outcome occurs. For information only. Not investment advice.