Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

Attackers exploited compromised application identities (service principals) within ConnectWise's Cloud Backup service to gain unauthorized access to Microsoft 365 tenant environments, bypassing MFA entirely because the attack operated through trusted service-level credentials rather than user accounts. This highlights a critical blind spot in MFA strategies: machine-to-machine identities and service principals are often unprotected by the same authentication controls applied to human users. Once inside, attackers escalated privileges by assigning themselves administrative roles, demonstrating how a single compromised third-party integration can cascade into full tenant takeover. Supply-chain attacks of this nature are particularly dangerous because organizations implicitly trust their vendors' tools, often granting them broad permissions with little ongoing oversight.