ConnectWise Suspends Cloud Services After Microsoft 365 Breach

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services starting October 17 after attackers compromised a Microsoft 365 API secret. The breach, first detected on October 15, allowed unauthorized actors to obtain Microsoft Graph access tokens and inherit broad permissions to access customer mailboxes, OneDrive, SharePoint, and Teams data.

Security firm Huntress identified nearly 1,000 attempted sign-ins to different tenants, with reports of successful unauthorized access in between 162 and 300 environments. Because the attackers used application-based authentication, they bypassed multi-factor authentication entirely. In some instances, the attackers escalated their privileges to global administrator rights and planted credentials in other applications to maintain persistence.

To contain the breach, ConnectWise disabled seven application identities and revoked associated certificates. While the company stated there is no evidence that encrypted stored backup archives were compromised, the service suspension prevents customers from restoring data. ConnectWise warned that these vendor-side actions do not reverse configuration changes or persistence mechanisms established within individual customer tenants, urging managed service providers to audit their environments for unauthorized directory modifications.