Chinese state-sponsored hackers used a single critical flaw in ConnectWise, a platform that IT providers use to manage clients remotely, to get inside thousands of businesses at once. One door. Thousands of rooms. This is not a data breach story. It is a supply chain ambush, and if your company uses a managed IT provider, you were almost certainly in the blast radius.
What Happened
ConnectWise ScreenConnect is remote access software used by managed service providers (MSPs) to control client computers and servers. Think of it as a master key. MSPs use it to fix your computers, update your software, and manage your network. When Chinese hackers found a way to abuse it, they did not just break into one company. They broke into the locksmith.
The vulnerability, tracked as CVE-2024-1709, carried a perfect 10 out of 10 severity score, according to the National Vulnerability Database. That is as bad as it gets. The flaw allowed attackers to bypass authentication entirely and take full control of any ConnectWise instance exposed to the internet. No password needed. No phishing email required. Just a crafted request, and the door opened.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog and issued an emergency directive, according to CISA advisories. By that point, threat actors including Chinese APT groups were already inside networks across finance, healthcare, legal, and manufacturing sectors.
ConnectWise serves more than 35,000 MSP partners worldwide, according to the company. Each of those partners manages anywhere from a handful to hundreds of client organizations. The math is ugly.
Why This Is a Financial Story, Not Just a Tech Story
Most coverage of this breach focused on the technical details. I think that is the wrong frame.
When attackers get inside through an MSP, they do not just look at code. They read emails. They pull financial records. They access accounting software, payroll databases, banking credentials, and customer data. For small and midsize businesses, this is not an inconvenience. It is an existential event.
Here is what the average business owner does when they hear about a breach like this: nothing. They assume their IT provider handled it. They assume someone patched the server. They assume the alerts would have told them if something was wrong. That is the broke mindset. That is how you get robbed quietly over six months while hackers sit in your network watching every wire transfer and deal you close.
The rich mindset asks different questions. Who has access to my systems right now? What third parties can see my payroll data? If my MSP was compromised, what exactly did they have access to inside my business? These are questions most business owners never ask until it is too late.
According to IBM’s Cost of a Data Breach Report, the average cost of a breach for a small business now exceeds $4.5 million when you factor in detection, response, lost business, and regulatory fines. That number climbs higher when the breach involves state-sponsored actors who move slowly and quietly to avoid detection.
One thing I tell every business owner: know what your financial exposure looks like at all times. If you are running corporate cards through multiple platforms with no visibility into who spent what and when, you are flying blind. Using a single platform like Wallester for business card management gives you transaction-level visibility so you can spot anomalies fast. When your accounts are compromised, speed matters. Thirty seconds of visibility beats thirty days of forensics.
What I Would Do Right Now
If your business uses a managed IT provider, take these steps this week. Not next quarter. This week.
First, ask your MSP directly whether they use ConnectWise ScreenConnect and whether they have patched CVE-2024-1709 and CVE-2024-1708. Get a written confirmation. If they cannot answer that question within 24 hours, find a new provider.
Second, pull your access logs. If you use cloud platforms like Microsoft 365, Google Workspace, or any financial software, review the login history for the past 90 days. Look for access from unusual locations, odd hours, or unfamiliar devices. This takes about 20 minutes and costs nothing.
Third, audit who has access to your payroll system. Payroll data is the crown jewel for attackers. It contains Social Security numbers, bank account details, salary information, and employee records. A breach here is not just a privacy problem. It is a direct financial weapon against your people. If you run payroll through Gusto, log in now and review your admin access list. Remove anyone who should not be there. Enable multi-factor authentication if you have not already. Gusto logs all admin actions, which gives you an audit trail if you ever need to prove what happened and when.
Fourth, assume your MSP was compromised and act accordingly. Change passwords for any system your IT provider had access to. Rotate API keys. Revoke remote access sessions. This is not paranoia. This is the correct default when your trusted provider becomes the attack vector.
Fifth, report anything suspicious to CISA at cisa.gov. State-sponsored intrusions have national security implications. Your report helps map the full scope of the campaign and may get you access to federal resources you would not otherwise have.
The Bottom Line
Your IT provider was the target. You were the prize. Chinese intelligence services do not care about your company specifically. They care about what your company knows, who your customers are, and what financial flows they can intercept or disrupt at scale. The ConnectWise breach was not a crime of opportunity. It was a coordinated campaign designed to get inside thousands of businesses through one trusted door. If you are still treating cybersecurity as an IT department problem and not a business survival problem, this breach is your wake-up call. The attackers already moved on. The only question is whether they took anything before they left.
Frequently Asked Questions
What is ConnectWise ScreenConnect?
ConnectWise ScreenConnect is remote desktop software used by IT service providers to access and manage client computers and servers. It lets IT technicians troubleshoot issues, deploy software, and monitor systems without being physically present. Because it provides deep system access, a flaw in ScreenConnect can expose every client an MSP manages.
How do I know if my business was affected by the ConnectWise hack?
Ask your IT provider directly whether they use ConnectWise and whether they patched CVE-2024-1709. You can also review login history in your cloud platforms and financial software for unusual activity. If you find anything suspicious, contact CISA and consider bringing in an independent forensics firm to verify your network is clean.
What did the Chinese hackers actually want from these companies?
State-sponsored Chinese threat actors typically pursue intellectual property, financial data, customer records, and strategic business intelligence. In fintech and finance targets, they look for wire transfer credentials, banking relationships, and deal flow information. Long-term persistence inside a network is common. They often stay quiet for months to maximize what they can collect.
Is using a managed IT provider still safe after this breach?
MSPs are still the right choice for most small and midsize businesses, but you need to treat them as a potential risk vector, not a security blanket. Require written confirmation of patch status for known vulnerabilities, limit what systems your MSP can access, and review their security certifications annually. The risk is manageable. The mistake is assuming someone else is managing it for you.
What is the difference between CVE-2024-1709 and CVE-2024-1708?
Both vulnerabilities affected ConnectWise ScreenConnect and were disclosed in February 2024. CVE-2024-1709 was the more severe of the two, scoring a perfect 10 out of 10, and allowed attackers to completely bypass authentication. CVE-2024-1708 was a path traversal flaw that enabled attackers to execute arbitrary code. Used together, they gave attackers full control over vulnerable systems.
