A stolen ConnectWise credential opened 173 Microsoft 365 tenants and AOMEI Backupper shipped a backdoor: check your IT provider's access in Mexico today

On October 17, 2026, news broke that someone used a compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants, as reported by The Hacker News. A tenant is your company’s master account in Microsoft: email, Teams, OneDrive and every user.

The day before, the same outlet reported that attackers tampered with AOMEI Backupper’s update servers for a few minutes to push a backdoor. AOMEI is common backup software in small offices and plants. Same lesson in both cases: nobody broke the door down. They walked through the one you opened for someone you trust.

Why your Mexico IT provider holds the biggest key

Most foreign companies with a plant, warehouse or office in Mexico rely on a local MSP (managed service provider) for hands and day-to-day admin. That provider usually needs access to Microsoft 365, servers and backups.

That is fine. What is not fine is a shared account, no MFA (multi-factor authentication, the code on your phone) and global admin rights that nobody at headquarters ever reviewed.

In our experience, HQ often audits its own vendors closely and forgets the one in Mexico. Or the one before that, who never got removed.

How to audit delegated access in Microsoft 365

Ask whoever holds global admin, at HQ or locally, to check:

1. Microsoft 365 admin center › Settings › Partner relationships. This lists every provider linked to your tenant.
2. Is the relationship DAP or GDAP? DAP is the legacy model: permanent global admin for the partner. GDAP (granular delegated admin privileges) grants only the roles needed, with an expiry date. If you see DAP, ask for it to be removed.
3. In Microsoft Entra › Users, filter guests and admins. Look for accounts like “support” or “admin2” that nobody can explain.
4. In Entra sign-in logs, review recent days for admin sign-ins from unusual countries or at odd hours for your Mexico time zone.

Healthy access	Risky access
GDAP, least-privilege roles, expiry	DAP with permanent global admin
One named account per technician	A shared “support” account
MFA enforced on every sign-in	Username and password only
Logs of who connected and what they did	Nobody reviews the logs

Require named accounts and MFA in the contract

A named account is “juan.perez@provider”, not “support@yourcompany”. If something goes wrong, you know who it was and can disable one account without locking everyone out.

Put it in writing: one account per technician, MFA, least privilege and notice when someone leaves the provider. We covered what happens when that fails in the engineer who locked 3,000 devices.

If your sites run AOMEI Backupper

• Open AOMEI › Help › About and note the version on each machine.
• In Settings › Apps, check the last update date and compare it with the window AOMEI publishes.
• If it matches, or you cannot tell, take that machine off the network, scan it with your antivirus or EDR and reinstall from the official site.
• Rotate passwords used on that machine, starting with the backup server.
• Run a test restore. A backup nobody has restored is a hope, not a backup. More in backups that actually restore.

How ProcessBi handles access

Our view: we would rather hold a few clearly labeled keys than all of them.

Under our IT support plans every technician uses a named account with MFA, GDAP with minimal roles, and every session is logged. Reviewing your tenant and testing restores is part of the plan, not an extra. Reports go to HQ in English.

And if you ever leave us, you get the full access list so you can close everything the same day.

Let’s talk

What about your Mexico operation?

Do you know today who else can sign in to your Microsoft 365 from Mexico? If the answer takes a while, start there: we review your provider’s access and your backups at no cost.

Book an access review — we reply the same business day.