Supply‑Chain Breach Forces ConnectWise to Suspend Cloud Backup Service After Microsoft 365 Tenants Compromised

ConnectWise announced the immediate suspension of customer access to its Cloud Backup service—formerly known as SkyKick Cloud Backup—after a cyber‑attack compromised application identities and gave threat actors footholds inside Microsoft 365 tenants. The shutdown follows the discovery that hackers had leveraged a supply‑chain vulnerability within ConnectWise's platform to infiltrate client environments.

The breach was first reported by security outlet BleepingComputer, which detailed that malicious actors were able to obtain credentials tied to ConnectWise’s integration with Microsoft 365. Those credentials were then used to access the cloud productivity suite of multiple organizations that rely on ConnectWise for backup and management services. By exploiting the trusted relationship between the two products, the attackers bypassed typical security controls that protect individual tenant accounts.

ConnectWise, a provider of software tools for managed service providers, has not disclosed the number of affected customers or the scope of data accessed. However, the company’s decision to temporarily disable the Cloud Backup service underscores the seriousness of the incident and its potential impact on businesses that store critical files and emails in Microsoft 365. The shutdown is intended to prevent further unauthorized activity while the firm conducts a forensic investigation and works with Microsoft to remediate the breach.

Supply‑chain attacks have risen in prominence over the past few years, with high‑profile incidents such as the SolarWinds compromise illustrating how attackers can infiltrate a single vendor and cascade across a wide network of downstream users. In this context, the ConnectWise incident highlights the risks inherent in tightly integrated SaaS ecosystems, where a single compromised component can expose numerous organizations to the same threat.

Industry analysts say the episode may prompt enterprises to reevaluate the security controls governing third‑party integrations, including stricter credential rotation, zero‑trust network segmentation, and continuous monitoring of privileged access. Microsoft has confirmed that it is cooperating with ConnectWise and affected customers to assess any lingering risks within the Microsoft 365 environment.

ConnectWise has pledged to restore the Cloud Backup service once it verifies that the underlying vulnerabilities have been fully addressed. The company is also expected to issue guidance to its customers on steps they can take to secure their Microsoft 365 accounts, such as enforcing multi‑factor authentication and reviewing delegated permissions. As the investigation proceeds, organizations that depend on ConnectWise and Microsoft 365 are advised to stay alert for any anomalous activity and to follow any remediation instructions issued by the vendors.