ConnectWise Suspends Cloud Backup Feature After Credential Leak Enables Microsoft 365 Intrusions

ConnectWise has temporarily shut down its cloud backup functionality after security researchers reported that threat actors used stolen ConnectWise credentials to gain access to Microsoft 365 environments belonging to downstream managed service providers.

The finding, first detailed by Dark Reading, indicates that attackers were able to authenticate to Microsoft 365 tenants by leveraging the same credentials that MSPs use to manage client networks through ConnectWise’s platform. By doing so, they could potentially view or exfiltrate email, documents, and other cloud‑based data.

ConnectWise, a leading provider of remote monitoring and management (RMM) and professional services automation (PSA) tools, issued a brief statement confirming the suspension of its cloud backup feature while it conducts an internal review. The company said it has not yet verified any direct impact on its customers, but it is working with affected parties to assess any exposure.

Security analysts note that the incident underscores the broader risk of supply‑chain attacks in the managed services ecosystem. MSPs often act as a single point of control for dozens or hundreds of client environments, so a breach of the MSP’s credentials can cascade to many downstream organizations. The use of compromised credentials to reach Microsoft 365 also highlights the importance of multi‑factor authentication and regular credential rotation.

In the meantime, ConnectWise has advised its users to review access logs, enforce MFA where possible, and consider alternative backup strategies until the service is restored. Industry observers expect the company to provide a more detailed incident report in the coming weeks, which could include recommendations for hardening the authentication flow between its platform and third‑party cloud services.

The episode arrives at a time when ransomware groups and other cybercriminals are increasingly targeting the administrative tools that MSPs rely on. Regulators and security standards bodies have been urging tighter controls on privileged access, and incidents like this may accelerate the adoption of zero‑trust architectures across the managed services market.

For clients of MSPs, the immediate takeaway is to maintain visibility into who has access to their cloud resources and to demand transparent communication from both their service providers and the technology vendors they depend on. As investigations continue, the industry will be watching how ConnectWise addresses the breach and what steps it takes to restore confidence in its backup solutions.