ConnectWise Cuts Off Cloud Access After Stolen App Credentials Exposed Microsoft 365 Tenants

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after discovering that attackers had obtained unauthorized access to seven of its application identities. The company detected the incident through internal monitoring on October 14 and took the services offline over the weekend to protect customer environments. This event affects organizations relying on ConnectWise for Microsoft 365 management and backup operations.

The risk

Attackers did not steal individual customer passwords. Instead, they compromised ConnectWise application credentials that already had permission to access customer Microsoft 365 environments for service management and backups. According to Security Affairs, the threat actors used these stolen identities to request access tokens from Microsoft Entra ID, effectively impersonating the legitimate applications. They did not need to steal any customer passwords to gain access.

Depending on the permissions granted to these applications, the attackers could access mailboxes, SharePoint documents, Teams messages, and directory data. The source material notes that ConnectWise’s applications already had permission to access customer environments to manage services and run backups, which the attackers abused.

Who is exposed

ConnectWise’s Cloud Backup service, formerly known as SkyKick, was directly impacted. The company revoked certificates used for affected application connections across all users, removing its own access through those channels. ConnectWise stated that the shared credentials previously used for Cloud Backup are no longer valid. The investigation extends across all partner-facing services, though the company reported no indication that other products were impacted.

Cost and compliance

ConnectWise disabled the compromised identities on October 17 and engaged a reputable third-party incident response firm to support containment efforts. The company’s security teams and Security Operations Center are actively monitoring the backup infrastructure. As of October 17, ConnectWise stated it had not observed successful threat activity in the environments it monitors since implementing mitigations.

What happens next

Managers should verify whether their organization’s Microsoft 365 environment was managed by ConnectWise Cloud Backup, SaaS Security, or Cloud Management. Review application permissions in Microsoft Entra ID to ensure no unnecessary access remains. Monitor for unusual activity in mailboxes and SharePoint sites, as attackers may have accessed data before the credentials were revoked.

Questions to ask your suppliers

Organizations should ask their cloud service providers how they manage application identities and whether credentials are shared across multiple customers. Determine if the provider uses least-privilege access models for Microsoft 365 integrations. Ask whether the supplier has a process for rotating application secrets and revoking access after incidents. Internal teams, including IT security and compliance officers, need to know if their data was potentially exposed. Review contracts to understand liability for third-party credential breaches and ensure incident response plans cover supplier compromises. Regular audits of granted permissions help reduce risk.

What to do and how to stay safe: ConnectWise

• Review all third-party applications with access to your Microsoft 365 environment and remove any that are no longer necessary.
• Enable multi-factor authentication for all administrative accounts and monitor for sign-ins from unfamiliar locations or devices.
• Check audit logs in Microsoft Entra ID for unusual token requests or access patterns from known service providers.
• Once the vendor provides an update, verify that new credentials are in place and that old certificates are fully revoked.

Step-by-step guide: Implement MFA for Cloud Accounts: A Step-by-Step Rollout Plan

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers steal customer passwords in this breach?

No, attackers stole ConnectWise application credentials, not individual customer passwords, to access Microsoft 365 tenants.

Which ConnectWise services were suspended?

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services after the compromise.

When did ConnectWise disable the compromised identities?

ConnectWise discovered the incident on October 14 and disabled the compromised identities on October 17.