ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise
Threat actors gained unauthorized access to ConnectWise application identities, enabling them to compromise Microsoft 365 tenants relying on the platform's cloud backup service. This incident highlights the cascading risk of compromised service application identities — when a trusted integration is hijacked, attackers inherit broad access to connected customer environments. The decision to suspend the cloud backup service underscores how a security incident in a managed service provider can simultaneously impact many downstream organizations. Businesses depending on third-party backup solutions must understand that their data protection posture is only as strong as their provider's security controls.
Tactical Insight
Immediate actions
- Audit and rotate all application identity credentials and OAuth tokens connected to Microsoft 365 tenants immediately.
- Disable or revoke any third-party application identities that are not actively verified as secure and necessary.
- Enable Microsoft 365 audit logging to detect unauthorized access or anomalous application activity across all tenants.
Long-term improvements
- Apply the principle of least privilege to all third-party application integrations, limiting permissions strictly to what is required for functionality.
- Implement a vendor risk management program that continuously evaluates the security posture of all managed service providers and cloud integrations.
- Maintain offline or geographically separated backup copies independent of any single cloud provider or managed service to ensure recoverability during provider-side incidents.
Detection measures
- Deploy continuous monitoring and alerting for unusual application identity activity, including unexpected consent grants or token issuances in Microsoft 365.
- Establish a formal incident response playbook specifically for third-party service compromises, including predefined criteria for service suspension and tenant isolation.