ConnectWise Pauses Cloud Backup After Stolen Credential Opens Door to Customers' Microsoft 365 Data

IT management software company ConnectWise shut down several services over the weekend after Microsoft and other security companies warned of a supply chain attack on its cloud backup system. ConnectWise first reported "attempts of unauthorized access" on Friday and confirmed it on Saturday. The interruptions affect Cloud Backup, SaaS Security and Cloud Management.

Incident responders at Huntress said a credential belonging to ConnectWise Cloud Backup was compromised and used to reach customers' Microsoft 365 environments. Microsoft said the attackers likely abused permissions that customers had previously granted to the application, including highly elevated ones such as Directory.ReadWrite.All. Huntress noted the tool needs broad access to mailboxes, OneDrive, SharePoint, Teams and other data, so a stolen credential gives wide reach, including places where no trail of evidence will be left.

ConnectWise said it has remediated the compromised credentials and identities, and it revoked certificates used for affected application connections, so previously shared Cloud Backup credentials no longer work. It said there is "no indication" backup data was compromised, and it has seen no successful threat activity since acting. However, it cannot see inside partner and customer environments, so it cannot say whether a particular Microsoft 365 tenant was breached. It did not say who the attackers were or how many customers were affected, and there is no timeline for restoring services.