ConnectWise has suspended its Cloud Backup service and disabled seven application identities after attackers used stolen credentials to gain unauthorized access to customer Microsoft 365 accounts, halting backups and restores while the company investigates.
ConnectWise said it detected unauthorized access on October 14 and disabled the identities on October 17. The affected services include Cloud Backup and several Cloud Management connections for Microsoft applications. According to the security firm Huntress, the compromised login credentials belonged to the backup application.
This allowed attackers to authenticate using an identity that customer systems already trusted, instead of breaking into each account separately. Huntress also found that in one partner account, a separate ConnectWise Teams application assigned itself Global Administrator privileges and added credentials to other applications. As of an update from ConnectWise on October 19, Cloud Backup, SaaS Security, and Cloud Management remained suspended.
This shutdown left scheduled backups, archive access, and data restores unavailable. ConnectWise stated that existing backup archives remain encrypted and preserved, with no evidence that attackers accessed them. The company has not confirmed when the suspended services will return.
ConnectWise reported no successful threat activity in the environments it monitors after putting protective measures in place. At the same time, the company warned partners to review their own and their customers' Microsoft 365 accounts and keep the affected applications disabled pending further instructions.