ConnectWise suspends Cloud Backup after attack on Microsoft 365 tenants

· Cybersecurity · United States

ConnectWise has suspended its Cloud Backup service and disabled seven application identities while it investigates unauthorized access to its Cloud Backup environment, which it confirmed on Saturday after initially saying Friday it was looking into the attempts. Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials, while the company says customer impact remains unconfirmed. The services stay offline as remediation and security validation continue. The case matters because ConnectWise software is widely used by managed service providers, so a compromise at the vendor can ripple downstream to many end customers. The immediate effect is that backup services for those MSP customers are unavailable while the investigation proceeds.

Why it matters：Vendor-level compromises at widely used MSP platforms can cascade to thousands of downstream organizations, and this incident highlights how third-party credentials become a path into customer cloud tenants.

Key points

  • ConnectWise initially disclosed the investigation on Friday and confirmed unauthorized access on Saturday.
  • Seven ConnectWise application identities were disabled during the investigation.
  • Researchers link the incident to attackers authenticating into Microsoft 365 tenants with ConnectWise credentials.

Sources (original reporting)

More stories from this day