started · updated
ConnectWise suspends Cloud Backup service after Microsoft 365 credential breach
ConnectWise has suspended its Cloud Backup service, formerly known as SkyKick, following a supply chain attack that compromised application credentials. The breach allowed unauthorized actors to access Microsoft 365 environments by exploiting a trusted OAuth application identity rather than individual user accounts, effectively bypassing multi-factor authentication (MFA).
Security firm Huntress confirmed unauthorized sign-ins in at least 162 to 173 Microsoft 365 tenants, though later reports indicated activity from the attacker’s address may have reached nearly 1,000 tenants. The attackers used the stolen credentials to gain broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data. Microsoft characterized the incident as an active supply chain attack where the attacker leveraged a service principal to pull Microsoft Graph access tokens.
ConnectWise has revoked the compromised certificates and cancelled the affected credentials. While the company stated there is currently no evidence that stored backups were accessed, the suspension of the Cloud Backup service means customers are temporarily unable to perform data restorations. ConnectWise has engaged a third-party incident response firm to assist in the ongoing investigation.
Entities
ConnectWise · Huntress · Microsoft · Microsoft 365 · SkyKick
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] Huntress later identified nearly 1,000 tenants showing activity from the attacker’s address. cybernoz.com · www.itnews.com.au
- [○ 1 SOURCE] ConnectWise suspended its Cloud Backup service and took SaaS Security and Cloud Management offline to mitigate the incident. securityaffairs.com
- [● 6 SOURCES] Security firm Huntress confirmed unauthorized sign-ins in at least 162 to 173 Microsoft 365 tenants. dijitaliyidir.com · cybernoz.com · www.hubsite365.com · www.security.nl · time.news · +1 more
- [● 2 SOURCES] ConnectWise stated there is no evidence that stored backups were accessed during the breach. cybernoz.com · www.itnews.com.au
- [○ 1 SOURCE] The company has engaged a third-party incident response firm to assist with the investigation. securityaffairs.com
- [● 2 SOURCES] Microsoft identified the incident as a supply chain attack involving the compromise of a trusted OAuth application. dijitaliyidir.com · www.security.nl
- [○ 1 SOURCE] Attackers added credentials for the service principal to compromised environments to maintain persistent access. www.security.nl
- [● 2 SOURCES] The attackers used the stolen credential to bypass multi-factor authentication (MFA) by signing in as an application rather than a user. dijitaliyidir.com · www.hubsite365.com