ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

Threat actors gained unauthorized access to ConnectWise application identities, enabling them to compromise Microsoft 365 tenants relying on the platform's cloud backup service. This incident highlights the cascading risk of compromised service application identities — when a trusted integration is hijacked, attackers inherit broad access to connected customer environments. The decision to suspend the cloud backup service underscores how a security incident in a managed service provider can simultaneously impact many downstream organizations. Businesses depending on third-party backup solutions must understand that their data protection posture is only as strong as their provider's security controls.