ConnectWise Disables Five Extensions Following Massive ScreenConnect Breach Impacting Hundreds of Devices

ConnectWise said it has turned off five partner‑provided extensions after security researchers disclosed a coordinated attack that leveraged the ScreenConnect remote‑access solution, compromising at least 288 endpoints across 48 organizations.

In an advisory posted on its site, the firm detailed that threat actors installed rogue client software to seize unauthorized control of the targeted devices. Although investigators are still determining the precise entry point, the incident seems to have exploited flaws in the ScreenConnect platform rather than any direct breach of ConnectWise’s own infrastructure.

ConnectWise stressed that, to date, there is no indication that its core systems or customer information have been compromised. Disabling the extensions is being done as a precaution to halt further propagation while the probe proceeds.

Analysts point out that the event highlights the dangers of third‑party add‑ons in remote‑access products, particularly as cyber‑criminals more often exploit supply‑chain pathways to broaden their impact. Companies employing ScreenConnect or comparable utilities are being advised to audit their security settings and install any pending patches.

Following the advisory, a number of impacted partners have started reviewing their endpoint management procedures and are collaborating with ConnectWise to reactivate the extensions only once they are verified clean of malicious code. ConnectWise also committed to working with law‑enforcement bodies and disseminating threat intelligence to the wider security community.

Experts argue that this breach may trigger a wider reevaluation of enterprise deployment of remote‑support tools, emphasizing stronger multi‑factor authentication, network segmentation, and ongoing monitoring of third‑party elements.

The situation is still evolving, and ConnectWise has pledged to issue additional updates as more information becomes available regarding the intrusion’s reach and the measures being taken to address any remaining threats.