- Published on
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
- Authors
- Name
- DeepHorus
ConnectWise has suspended its Cloud Backup service and disabled seven application identities after unknown attackers gained unauthorized access to those identities and compromised Microsoft 365 tenants. The IT management software provider said the action took effect on October 17, 2026, at 07:00 UTC, as its investigation continues. The company also revoked certificates used for affected application connections across all users. ConnectWise warned that disabling the connections prevents new authentication but does not reverse changes already made inside a tenant.
The disabled identities include ConnectWise Cloud Backup, Cloud Management, Cloud Management for Microsoft Teams, Exchange Online, MS Graph, Partner Center, and SharePoint Online. The company identified the issue on October 14, 2026, through advanced cybersecurity monitoring and diligence. It then activated internal and external incident investigation and response actions. Since implementing mitigations, ConnectWise said it has not observed successful threat activity in environments it monitors, though it cannot directly observe downstream customer environments.
Scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. ConnectWise emphasized that existing archives remain encrypted, isolated, and preserved. It said there is no evidence the archives were breached or accessed by the attackers. The affected shared Cloud Backup credentials are no longer valid, but previously issued access tokens may remain usable until they expire or are otherwise invalidated.
The incident is dangerous because attackers can abuse an application's credentials to access customers' Microsoft 365 environments without stealing each customer's password. By authenticating as the application, an attacker can request access tokens from Microsoft Entra ID based on the application's existing permissions. Depending on those permissions, the attacker could potentially reach mailboxes, SharePoint documents, Teams messages, and directory information. ConnectWise applications operate with extensive permissions for backups and management tasks.
The theft of the credential could let a threat actor authenticate as the application and expand access by adding it to the Global Administrator role. Attackers could also add client secrets to other trusted applications in the tenant and create new applications with permissions. Such client secrets offer a way to authenticate as that application and establish persistence. This provides an alternative means to regain access even if the original access is removed.
Out of an abundance of caution, ConnectWise temporarily took SaaS Security and Cloud Management offline while it completes its review. The company said unauthorized credentials, permissions, or other access established through separate identities require additional review and remediation. It remains unclear whether a product vulnerability contributed to the compromise. The exact credential-exposure mechanism is still under analysis.
The incident highlights the growing risk of application identity compromise in cloud ecosystems. Because a single stolen credential can affect many downstream customers, the potential impact extends beyond one organization. ConnectWise has not disclosed how many customers or tenants were affected. The company continues to investigate the scope and root cause.
ConnectWise said it will provide updates as its review proceeds. Customers are advised to review their own Microsoft 365 tenants for unauthorized changes, permissions, and applications. The company noted that its monitoring findings do not establish the status of downstream customer environments. Remediation may require additional action from affected organizations.
