ConnectWise Suspends Cloud Backup After Microsoft 365 Tenant Breach, Halting Backups and Restores
ConnectWise has suspended its Cloud Backup service and disabled seven app identities after attackers compromised Microsoft 365 tenants, leaving backups and restores temporarily unavailable.
A security breach tied to Microsoft 365 tenants has forced ConnectWise to shut down a core data‑protection service, cutting off automated backups and restores for customers while the company investigates.
ConnectWise said it has suspended its Cloud Backup product and disabled seven application identities after attackers compromised Microsoft 365 tenants. Those identities are the app connections Cloud Backup uses to access customer Microsoft 365 environments.
With Cloud Backup suspended and the app identities disabled, backups and restores are currently unavailable. Organizations that rely on the service to protect email and documents in Microsoft 365 face a window in which new data is not being backed up through this platform and rapid restores are not possible.
The incident illustrates how a compromise at one vendor can spread risk across many downstream clients. ConnectWise tools are widely used by managed service providers to run and secure customer cloud environments, so a breach affecting those connections can have broad impact.
The Hacker News reported that ConnectWise has suspended Cloud Backup and disabled seven app identities after attackers compromised Microsoft 365 tenants, and that backups and restores are unavailable. It also noted that previously issued access tokens may remain valid.
For customers, key questions now are how the attackers gained access, what data or systems were exposed, and when Cloud Backup can be safely restored. For the wider market, the case is a reminder that third‑party applications with tenant‑wide permissions in Microsoft 365 need the same level of scrutiny as in‑house admin accounts.
Signals to watch include ConnectWise’s root‑cause findings, any disclosure of affected customers, changes to how app identities are secured in Microsoft 365, and whether regulators or large clients push for tighter controls on similar integrations.
Sources
- OSINT