ConnectWise Disables Five Extensions After Massive ScreenConnect Breach Impacts Hundreds of Devices

ConnectWise said it has turned off five partner‑provided extensions after security researchers disclosed a coordinated attack that leveraged the ScreenConnect remote‑access application, compromising a minimum of 288 endpoints across 48 distinct organizations.

In an advisory posted on its site, the firm detailed that the attackers installed rogue client code to seize unauthorized control of the targeted computers. Although investigators are still probing the precise entry point, the incident seems to have exploited flaws in the ScreenConnect platform rather than a direct breach of ConnectWise’s own services.

ConnectWise stressed that, to date, there is no indication that its core infrastructure or client data have been compromised. Disabling the extensions is being done as a precautionary step to curb any further propagation as the probe proceeds.

Analysts point out that the breach highlights the dangers tied to third‑party add‑ons in remote‑access products, particularly as threat actors more often exploit supply‑chain pathways to broaden their impact. Companies that rely on ScreenConnect or comparable solutions are being advised to audit their security settings and install any relevant patches.

Following the advisory, a number of impacted partners have started reviewing their endpoint management procedures and are coordinating with ConnectWise to reactivate the extensions solely after verifying they contain no malicious code. The firm also committed to collaborating with law‑enforcement bodies and disseminating threat intelligence to the wider security ecosystem.

Specialists argue that this event may trigger a wider reevaluation of enterprise deployment of remote‑support tools, emphasizing stronger multi‑factor authentication, network segmentation, and ongoing surveillance of third‑party elements.

The situation continues to evolve, and ConnectWise has pledged to issue additional updates as further information about the breach’s extent and mitigation measures becomes available.