ConnectWise Halts Cloud Backup Service After Threat Actors Breach Microsoft 365 Identities

ConnectWise announced on Saturday that it has shut down its cloud backup offering after discovering that unknown threat actors gained unauthorized access to several of its application identities and used them to infiltrate Microsoft 365 tenant environments.

The company said it disabled seven specific ConnectWise application identities as an immediate containment step while it continues a forensic investigation. According to the statement, the compromised identities were leveraged to obtain credentials that allowed the attackers to move laterally into Microsoft 365 services linked to ConnectWise customers.

ConnectWise, a well‑known provider of professional‑services automation, remote monitoring and management, and cloud backup solutions, integrates tightly with Microsoft 365 to back up emails, files, and other collaboration data for managed service providers and their end‑user clients. The breach therefore raises concerns not only for the integrity of backup data but also for the broader security of the Microsoft 365 ecosystems that rely on those integrations.

While the company has not disclosed the number of affected customers, it warned that the incident could expose sensitive corporate information stored in the compromised tenants, including email communications and shared documents. Service disruption is expected for users of ConnectWise’s backup platform until the compromised identities are fully remediated and additional safeguards are put in place.

Security analysts note that the attack fits a pattern of supply‑chain style intrusions where adversaries target trusted third‑party integrations to reach a larger pool of victims. By compromising application identities rather than individual user accounts, attackers can often bypass multi‑factor authentication and other perimeter defenses that organizations have deployed for their own staff.

ConnectWise said it is working closely with Microsoft and relevant law‑enforcement agencies, and it will issue further updates as the investigation progresses. The company also urged customers to review their own access controls, rotate any credentials that may have been shared with ConnectWise services, and monitor for unusual activity within their Microsoft 365 environments. Industry observers expect that the incident may prompt broader reviews of third‑party integration security across the managed‑services sector.