ConnectWise has taken its Cloud Backup service offline after detecting unauthorized access to application identities within the environment. The company said it identified the activity on October 15 and, as an precaution, also suspended SaaS Security and Cloud Management because they are integrated with Cloud Backup. As of October 18, the services remain unavailable, meaning end-users cannot back up data, access archives, or perform restores.
Security firm Huntress offered a starker assessment, alleging that a Microsoft 365 credential belonging to ConnectWise Cloud Backup was compromised and is being used to gain unauthorized access to customers' M365 environments. In one partner tenant, Huntress said a ConnectWise application granted itself Global Administrator and added credentials to other apps. Huntress warns that disabling the abused applications will not remove credentials that were already added.
ConnectWise has not commented on threat actor attribution and is instead asking MSPs to inspect the M365 environments they manage for signs of compromise. Because MSPs are not obligated to disclose which platforms they use, end-user organizations may be unaware that they are affected. ConnectWise says existing archives remain encrypted, isolated, and show no evidence of unauthorized access, but the incident highlights how attacks on MSP platform vendors can ripple through many downstream customers.