ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise disables seven application identities and suspends Cloud Backup service after attackers compromised Microsoft 365 tenants. The company has taken SaaS Security and Cloud Management offline for review.
Intelligence analysis by Qwen 2.5 (3B)
IT management software provider ConnectWise suspends Cloud Backup and disables seven application identities after attackers compromised Microsoft 365 tenants, raising concerns about potential security breaches.
ConnectWise had a problem where bad guys got into their software and could see and use other people's Microsoft stuff. They fixed it by stopping their backup service and disabling some parts of their software.
Analysis
{"heading":"Background on the Incident","subheading":"ConnectWise's Investigation and Response","content":["ConnectWise identified the issue on October 14, 2026, through its advanced cybersecurity monitoring and diligence. The company took immediate action by disabling the affected connections and suspending the Cloud Backup service.","The compromised application identities allowed attackers to access customers' Microsoft 365 environments without needing to steal individual passwords. This breach could have exposed sensitive data and compromised the security of multiple tenants.","ConnectWise emphasized that existing archives remain encrypted, isolated, and preserved, and that there is no evidence they were breached or accessed by the attackers."]}
Key points
- ConnectWise disabled seven application identities and suspended Cloud Backup service
- Attackers compromised Microsoft 365 tenants through compromised application identities
- ConnectWise took immediate action to prevent further damage
This incident may lead to better security measures for other companies to prevent similar breaches in the future.
The compromised data could still be at risk, and the incident might cause further damage to affected customers' systems.
