CONNECTWISE has suspended access to several cloud services after detecting unauthorized access to Microsoft 365 tenants. The investigation began on 15 October, with the company confirming on 19 October that the attackers accessed application identities within the ConnectWise Cloud Backup environment. As a precaution, ConnectWise temporarily took offline Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management while it probes the incident and assesses impact.
Officials say the attacker could exploit the stolen credentials to sign in to the customer’s Microsoft 365 environment via the backup service’s app, obtaining tokens with the app’s existing permissions and thereby accessing the same mailboxes, OneDrive and SharePoint files, Teams data and directory information the backup tool can reach. Since the credential belongs to the application itself, multi-factor authentication does not apply for this app sign‑in, meaning no user, device or MFA prompt would be triggered.
Huntress notes that in at least one observed customer tenant, an attacker was able to acquire a Global Administrator role and attempted to modify permissions for other apps.
ConnectWise says there is no confirmed restoration time and is continuing to investigate, while advising customers to verify application connections, preserve sign-in and audit records, review authentication and federation configurations, check for mailbox forwarding and delegated access, and investigate any identities changed during suspicious activity. At present there is no attribution publicly identified.