ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

ConnectWise has suspended its Cloud Backup service after unknown threat actors gained unauthorized access to ConnectWise application identities. The attackers used these compromised identities to access and compromise Microsoft 365 tenants belonging to ConnectWise customers. ConnectWise responded by disabling seven application identities, including ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae). An investigation is ongoing to determine the full scope of the incident. The suspension of the cloud backup service impacts customers relying on ConnectWise for Microsoft 365 data protection. The incident highlights risks associated with third-party application identities having access to cloud tenants.