Summary
- ConnectWise detected unauthorised access to application identities within its Cloud Backup environment on 15 October, prompting a service suspension that remained in effect as of 18 October.
- Cloud Backup, SaaS Security, and Cloud Management services are all offline; end-users cannot back up, access archives, or restore data.
- Security firm Huntress confirmed that a compromised ConnectWise M365 API credential was used to gain unauthorised access to customer Microsoft 365 tenants, with at least one compromised app elevating itself to Global Administrator.
- Disabling affected M365 applications does not remove credentials already added — all M365 application credentials must be reviewed.
- MSPs using ConnectWise are not obligated to disclose the platform to their end-customers, meaning affected businesses may be unaware of their exposure.
What happened
On 15 October, ConnectWise identified unauthorised access to application identities within its Cloud Backup environment — a platform used by managed service providers to protect data stored on-premises, in the cloud, and in SaaS services including Microsoft 365 and Google Workspace. The company moved quickly to suspend Cloud Backup along with its integrated SaaS Security and Cloud Management offerings. As of 16:00 UTC on 18 October, all three services remained unavailable.
Scope of the disruption
The suspension has a direct operational impact: MSPs and their customers cannot back up data, access existing archives, or perform restores. ConnectWise’s vice president of security operations, Jason Ferguson, noted on Reddit that existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorised access to stored data. The company characterised the shutdown as a precautionary measure while forensic analysis, threat hunting, and remediation continue.
Credentials abused in M365 environments
The picture became more concrete when security firm Huntress disclosed that a Microsoft 365 API credential — specifically an API secret — belonging to ConnectWise Cloud Backup had been compromised and was actively being used to gain unauthorised access to customer M365 environments. In one Huntress partner tenant, a second ConnectWise application, ConnectWise Cloud Management – MS Teams, elevated its own permissions to Global Administrator and then added new credentials to two other applications in that tenant, including a Huntress application unique to that partner.
A critical remediation caveat
Huntress issued a warning that security teams should not assume that disabling M365 applications closes the exposure. Credentials already added to applications persist after those apps are disabled. Every M365 application in any environment connected to ConnectWise Cloud Backup must be reviewed for newly added credentials. ConnectWise has also disabled integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products, and published a small set of indicators of compromise tied to IP addresses and third-party app integrations.
The MSP supply chain problem
ConnectWise occupies a position that makes incidents like this particularly complex to manage. As a platform provider, it has no visibility into the end-customer environments that its MSP partners manage — nor should it, given the nature of the relationship. It is therefore relying on MSPs to investigate their own M365 estates and notify customers where warranted. The complication is that MSPs are under no obligation to disclose which platforms underpin their services, and many end-customers will have no knowledge that ConnectWise plays any role in their IT environment. Those businesses are effectively dependent on their MSP acting promptly and transparently.
Attribution and context
ConnectWise stated it cannot discuss threat actor attribution while investigation and remediation are ongoing. The company has not confirmed how many partners or end-customers are affected. The incident echoes the 2021 Kaseya attack, which is frequently cited as the benchmark for MSP supply chain compromise. Businesses that serve MSPs present an attractive target because a single breach can cascade through an entire partner ecosystem and their downstream customers.
Why it matters
For CISOs whose organisations use an MSP, this incident is a reminder that supply chain exposure extends well beyond direct vendor relationships. If your MSP uses ConnectWise Cloud Backup, your M365 environment may have been accessed without your knowledge — and your MSP may not proactively tell you. More broadly, any application granted elevated M365 permissions represents a persistent credential risk that survives the disabling of the originating application. CISOs should treat third-party application identities within their M365 tenants as a standing audit requirement, not a one-time configuration task.
What to do now
- If your organisation uses an MSP, ask directly and in writing whether ConnectWise Cloud Backup, SaaS Security, or Cloud Management is part of their toolstack.
- Audit all application registrations and service principals in your Microsoft 365 tenant, paying close attention to any recently added credentials or elevated permissions.
- Do not rely solely on disabling ConnectWise M365 applications — review and revoke any credentials that may have been added to all M365 applications, including those unrelated to ConnectWise.
- Check ConnectWise’s published indicators of compromise against your environment’s logs, including the IP addresses and third-party app integration identifiers the company has released.
- Request a written incident notification from your MSP confirming whether your environment was affected and what remediation steps have been taken on your behalf.
