ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations

Attackers exploited a third-party extension (RMM+) integrated with ConnectWise ScreenConnect to execute remote commands across nearly 50 organizations, demonstrating how supply chain components can dramatically expand an attack surface. The root cause was the availability of an unsanctioned or insufficiently vetted API extension that granted broad remote execution capabilities without adequate controls. Because technician workstations were also compromised, the breach extended beyond the tool itself into privileged operator environments. This incident illustrates that every third-party plugin, extension, or integration must be treated as a potential attack vector and subjected to the same scrutiny as core software.