Hackers Breach 173 Microsoft 365 Tenants via ConnectWise Cloud Backup

· Cybersecurity · United States

Researchers have disclosed an active campaign in which unknown threat actors used a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup, formerly SkyKick Cloud Backup, to sign in to 173 customer Microsoft 365 tenants. The attackers gained access by way of application identities tied to the backup service, which holds privileged connections into customers' mail and data environments. ConnectWise has shut down customer access to the Cloud Backup service in response while it investigates. The incident is a supply-chain case: customers were not breached through their own credentials but through a trusted SaaS vendor that had been granted broad access to their tenants. Affected organizations face potential exposure of mailboxes and stored data, and administrators are being urged to review third-party application grants and revoke unused consent.

Why it matters：It shows how a single privileged SaaS integration can become a mass compromise vector across hundreds of downstream organizations, pushing enterprises to audit third-party app consent and vendor access.

Key points

  • Hackers used application identities tied to the backup service, not customer passwords.
  • ConnectWise cut off customer access to Cloud Backup while investigating.
  • The campaign targeted 173 Microsoft 365 tenants.

Sources (original reporting)

More stories from this day