After the ConnectWise breach, a firm’s GDPR clock may start before its Microsoft 365 logs can answer

Editor’s Note: Microsoft said Oct. 21, 2026, that it assesses Storm-0940, a China-state aligned hacking group, was responsible for the compromise of ConnectWise Cloud Backup, a Microsoft 365 backup service once called SkyKick, and that some of the group’s attacks reached privileged cloud access within three hours of first targeting. ConnectWise, which first disclosed the incident Oct. 16, said a China state-aligned group appeared to be responsible. Microsoft listed legal among the targeted industries without saying whether any law firm was compromised.

For cybersecurity, privacy and eDiscovery professionals, the issue is timing. Under the European Union’s General Data Protection Regulation, a controller must notify its supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put individuals’ rights and freedoms at risk. European regulators expect any alert to be investigated promptly, and details can follow in phases.

ConnectWise said it cannot see into customer environments, and Microsoft’s Entra identity service keeps sign-in and audit logs for seven days on its free tier. Watch for ConnectWise’s restoration instructions and any count of compromised organizations.

News Analysis – Cybersecurity Beat

After the ConnectWise breach, a firm’s GDPR clock may start before its Microsoft 365 logs can answer

ComplexDiscovery OÜ Staff

Microsoft assessed Oct. 21 that China-state aligned Storm-0940 was behind the ConnectWise compromise and that some of its attacks, driven by artificial intelligence (AI) agents, reached privileged cloud access within three hours of first targeting.

Legal sits on Microsoft’s list of targeted industries, yet a law firm’s notification duties are not measured from the moment of intrusion. Europe’s 72-hour clock runs from awareness of a breach, and in an attack routed through a vendor’s application, the records a firm needs to judge what happened may already be gone.

The attribution came in a post by Microsoft Security Research and Microsoft Threat Intelligence. It said Storm-0940 has used ARTEX, an open-source framework for penetration testing that works with any AI model, to automate attacks on hundreds of organizations since September 2026. Microsoft described the group as active since 2021, focused on data theft and carrying no known industry aliases. ConnectWise accepted the finding in hedged terms the same day. Citing its own evidence and threat intelligence from Microsoft, the company said a China state-aligned group appeared to be behind the attack on its Cloud Backup service, formerly known as SkyKick.

How the campaign moved at machine speed

What Microsoft singled out was the tempo rather than the technique. Storm-0940 has long relied on password spraying and on planting new credentials on OAuth applications already present in a tenant, the company said, and ARTEX pushed that familiar playbook to what Microsoft called machine speed. After the unauthorized access at ConnectWise, according to the post, the group used the framework to attempt sign-ins to over 2,250 tenants at 2,900 sign-in attempts per minute.

An earlier password-spray campaign ran from Oct. 10 to 14. It targeted 327 accounts across eight organizations and produced over 151,000 failed logon events, and Microsoft said it saw no successful authentication in that campaign. Microsoft linked that campaign to the ConnectWise intrusion through overlapping infrastructure, noting that one address it used later appeared among the indicators ConnectWise published. Huntress, a security company that published early analysis of the incident, said in an Oct. 19 update that it did not believe password spraying from some of the other published addresses was related to the application sign-ins it was tracking.

Huntress did place one spray at the same address as those sign-ins. It said the address later used to sign in with the vendor’s credentials had sprayed four law firm tenants on Oct. 13 and 14, though its telemetry recorded no user sign-in from that address that succeeded.

The decisive access came through the vendor’s own application credentials rather than through anyone’s password. ConnectWise said it discovered the problem Oct. 14 and published its first advisory Oct. 16. In a post on X reported by The Hacker News, Microsoft said it saw widespread successful sign-ins by the Cloud Backup application’s service principal from the attacker’s address on Oct. 15. Jonathan Semon, a Huntress security researcher quoted by the same publication, said the actor worked through tenants in sorted order only seconds apart, which he read as a script running down a target list.

Huntress said that by Oct. 16 it had confirmed sign-ins by the intruder in 162 partner and customer tenants. A day later it reported almost 1,000 tenants that logged sign-in activity originating at the attacker’s address, with successful sign-ins in over 300 of them, and it did not present those sign-ins as proof that data was taken. In some environments, Microsoft said, the AI agents went on to run reconnaissance through Microsoft Graph, alter application credentials so they could return later, and make “changes involving identities, groups, and privileged roles.” The company said most of the targeting failed, but that the group still “achieved privileged cloud persistence at many organizations in a brief time.”

Microsoft gave no count of compromised organizations. “The presence of an affected application, or even successful authentication, does not necessarily indicate unauthorized data access or data exfiltration,” the post said. Microsoft’s list of targeted industries includes legal, alongside sectors from aerospace and defense to semiconductors and think tanks, but the post gives no count of legal-sector targets. Neither Microsoft’s post nor ConnectWise’s advisory says whether any law firm was among the organizations reached.

When the legal clocks actually start

That uncertainty is where the notification problem begins, because neither of the two regimes examined here runs from the moment of intrusion. Article 33 of the European Union’s General Data Protection Regulation sets the clock for a controller, the organization that decides why and how personal data is processed. It must report a personal data breach to its supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it.” No report is required when the breach is unlikely to put individuals’ rights and freedoms at risk. A processor, which handles data on the controller’s behalf, must alert the controller “without undue delay after becoming aware” of a breach.

Awareness, in the regulators’ reading, does not wait for a forensic report. Guidelines from the European Data Protection Board treat a controller as aware once it has “a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised.” In principle, the board adds, that point arrives once a processor has told the controller of the breach. A controller alerted by an outside source may take a short period to investigate. The board expects that inquiry to start as soon as possible, and it warns that a controller slow to act on an alert, where a breach did in fact occur, could be treated as having failed to notify.

The regulation also anticipates incomplete facts. Where a controller cannot provide all the required information at once, Article 33 lets it supply the information “in phases without undue further delay,” and the board names complex cyber incidents needing in-depth forensic work as a likely example. A notification made after 72 hours must come with reasons for the delay.

The American Bar Association (ABA) took up the ethical side in Formal Opinion 483, issued in 2018. “When a lawyer knows or reasonably should know a data breach has occurred, the lawyer must evaluate notice obligations,” the opinion says. Current clients must be told of a breach “involving, or having a substantial likelihood of involving, material client confidential information.” The opinion’s definition of a breach also reaches an episode “where a lawyer’s ability to perform the legal services for which the lawyer is hired is significantly impaired.”

The opinion sets no numerical deadline, but it does address uncertainty. Lawyers must tell clients “the known or reasonably ascertainable extent” of what was accessed or disclosed, and if reasonable efforts cannot establish that extent, the client must be told so. Opinion 483 also cites the committee’s 1995 Opinion 95-398, which it describes as saying “notice must be given to clients if a breach of confidentiality was committed by or through a third-party computer vendor or other service provider.” Opinion 483 adds that the 1995 opinion found such notice may be required for a “serious breach.” The ABA notes that the laws, rules and ethics opinions of individual jurisdictions control, and that statutory notice duties are separate from these ethical ones.

Awareness arrives in pieces

For firms downstream of ConnectWise, the information comes in fragments. ConnectWise said its Cloud Backup design gives it no visibility into downstream partner and customer environments, so its own investigation cannot determine whether a particular customer’s Microsoft 365 tenant saw unauthorized activity. The company asked its partners, along with resellers, distributors and marketplace partners, to make sure its guidance reached the administrator of each customer tenant.

A general vendor warning about possible exposure differs from a processor’s notice that a breach has occurred, and it is not proof that a particular firm’s personal data was compromised. Under the board’s guidance, though, it is the kind of alert a controller must act on promptly, whether it arrives directly or through a managed service provider. The firm’s own tenant records are an important source for that investigation, alongside what the vendor and any processor report. Missing records make the assessment harder, while the guidance treats delay in acting on an alert as a risk of its own.

Privileged access in hours, logs kept for days

Some of those tenant records have short default lives. Microsoft’s own documentation says Entra ID keeps sign-in and audit logs for seven days on its free tier and 30 days on the P1 and P2 tiers. It treats the Microsoft 365 unified audit log as a separate record, with retention set through Microsoft Purview. Microsoft Graph activity logs, which capture the kind of follow-on activity Microsoft attributed to the AI agents, exist only on the paid tiers. They are not retained unless an organization routes them to storage or an analytics tool, and ConnectWise’s guidance adds that a license upgrade does not recover expired history.

The arithmetic is unforgiving. ConnectWise asks partners to review activity from Oct. 13 onward, and on the free tier’s seven-day window, records from that date would normally have aged out before Microsoft published its attribution on Oct. 21. Huntress said Microsoft’s standard audit log does not capture what an application reads from the directory through Microsoft Graph. Microsoft’s separate Graph activity logs do keep an audit trail of every request the service receives, but only when an administrator on a paid tier has switched collection on and sent it to a destination.

Microsoft told defenders that an empty search “should not be treated as confirmation that no access occurred,” and ConnectWise said a finished checklist is no guarantee that a tenant escaped. Those caveats feed directly into the notification decision. Article 33 also requires controllers to keep a record of each breach, covering what happened, what it affected and how it was remedied, detailed enough that the supervisory authority can verify compliance.

Microsoft, whose post also promotes its own detection products, gave customers the same preservation advice as ConnectWise. Both told them to keep Entra sign-in and audit records, Purview audit data and security information and event management data before making irreversible changes, and not to delete the affected enterprise applications as a first response. Both also said urgent containment should not wait for log exports to finish.

ConnectWise went further, telling tenant owners to record their log coverage, findings, containment times and unresolved questions for each tenant. For information governance and eDiscovery teams, that record is likely to become the evidence a firm relies on when it explains a notification decision, or a delay, to a regulator, a client or an insurer. It deserves the same preservation discipline as any other potentially relevant material.

Revocation does not close the window instantly either. Nicholas Koken, head of detection engineering at the security company Todyl, described the lag in remarks published by The Hacker News. Turning the app off in a tenant halts the issuing of fresh tokens, he said, but tokens handed out before the shutdown keep working for as long as 90 minutes.

An open-source tool that outlived its own withdrawal

The tool behind the speed belongs to no single actor. Microsoft describes ARTEX as a set of cooperating large language model agents, built in Go with a Next.js web interface. The company said the agents can carry a penetration test from first reconnaissance to the theft of data with minimal human direction, and that groups in several regions now use it. Earlier in October, CrowdStrike reported that an actor it had not tied to any named adversary used ARTEX alongside large language models in a campaign aimed at South Korean financial organizations that ended in stolen data.

CrowdStrike judged, with moderate confidence, that the actor was likely a Chinese speaker with a financial motive. After that disclosure, the developer known as Autumn-27 said the project would stop receiving updates and go closed source, according to The Hacker News. The original GitHub repository returned a page-not-found response on Oct. 22. A public fork that calls itself “a source-only backup of the final ARTEX version,” translated into English and released under the AGPL-3.0 license, remained available the same day.

Withdrawing the original project did not withdraw the code already released. The surviving fork’s installation notes call for a PostgreSQL database and a key for a large language model service, and CrowdStrike concluded that such tooling let a profit-driven actor run several intrusions in a short span. Whoever runs it, the defensive question is the same: whether the logs exist to show what an agent did in the hours before anyone noticed.

What firms and their vendors can settle before the next one

In the article’s analysis, several steps follow from the record Microsoft and ConnectWise have published. Firms can confirm which Entra tier each tenant runs and whether sign-in, audit and Graph activity logs are routed to storage that outlasts the default window, because a retention gap found during an incident cannot be closed afterward. They can inventory third-party applications holding broad Microsoft 365 permissions, the category of access Storm-0940 exploited. And they can check that vendor and managed service provider contracts move breach information along the path Article 33 describes, from processor to controller to regulator.

For ConnectWise customers the incident remains open: the company said Oct. 22 that it was restoring Cloud Backup in phases over several days, and it told partners to leave affected connections off until it issues formal instructions. Microsoft said no compromise of, or vulnerability in, its corporate systems, products or services caused the activity.

Microsoft measured the attacker’s path in hours. Europe’s notification clock starts at awareness and the ABA’s opinion sets no numerical deadline. Once the applicable notification threshold is met, neither requires a complete forensic account before notice. When the records a firm would use to judge what happened can expire in seven days by default, how many firms could say today whether their own clock has already started?

News sources

• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft)
• Trust Center | Advisories | ConnectWise (ConnectWise)
• Consolidated TEXT: 32016R0679: EN: 04.05.2016 (EUR-Lex)
• Guidelines 9/2022 on personal data breach notification under GDPR (European Data Protection Board)
• Formal Opinion 483: Lawyers’ Obligations After an Electronic Data Breach or Cyberattack (American Bar Association)
• Microsoft Entra data retention: Microsoft Entra ID | Microsoft Learn (Microsoft)
• Access Microsoft Graph activity logs for tenant monitoring: Microsoft Graph | Microsoft Learn (Microsoft)
• Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (CrowdStrike)
• Error336070/ARTEX: The ARTEX agentic penetration testing framework, ported to English with extra modifications planned for further development of the tool to improve performance & utility (GitHub)
• Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants (The Hacker News)
• ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms (The Hacker News)
• Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group (CyberScoop)
• ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks (Huntress)

Assisted by GAI and LLM Technologies

Additional reading

• AI changes the economics of hybrid threats but not their logic, Helsinki paper argues
• A warned Vilnius Starlink site puts CISA’s 3-day patch clock in context
• Refrigeration hack affected about 700 French supermarkets, government says, as Danfoss interfaces stay online
• MonsterCloud indictment exposes the ransom payment a victim’s own file may not record
• Wikimedia publishes its own account of suspected OpenAI agent activity on its wikis
• Cyber Law Toolkit tests AI deception, cyber torture and peacetime cyber duties
• ENISA Threat Landscape 2026 finds DDoS leads incident counts while ransomware stays most impactful in the short term
• Cyber Resilience Act reporting starts Sept. 11 on an unfinished platform

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more understandable for practitioners, policymakers, and business leaders.