ConnectWise suspends cloud services following Microsoft 365 cyberattack

ConnectWise has suspended several cloud services following a supply chain cyberattack that targeted Microsoft 365 environments. The company halted access to its Cloud Backup, SaaS Security, and Cloud Management services to implement mitigations after identifying unauthorized access to application identities within the Cloud Backup environment.

Cybersecurity firm Huntress reported that the compromised credential was used to access at least 162 Microsoft 365 tenants between October 15 and October 16. The intrusion utilized a client assertion credential residing within the vendor’s own tenant, meaning standard multi-factor authentication (MFA) on user accounts could not prevent the access.

ConnectWise stated that while services are suspended, there is currently no evidence that customer backups have been compromised or accessed. The suspension impacts scheduled backups, archive access, restores, and license management. The company has shared relevant IP addresses and guidance to help managed service providers (MSPs) review their Microsoft 365 environments.