ConnectWise disclosed on October 18 that unknown attackers used stolen credentials tied to its own applications to reach into customer Microsoft 365 accounts, forcing the company to suspend its Cloud Backup service and take two other products offline while it investigates. The intrusion ranks among the more consequential software-supply-chain incidents of the year because it exploited the trust customers place in a managed-service-provider platform rather than any single customer's password.
ConnectWise, based in Tampa, Florida, and used by tens of thousands of IT service providers to manage client networks, said its "advanced cybersecurity monitoring" flagged the activity on October 14. Three days later, at 07:00 UTC on October 17, the company disabled seven application identities registered inside customers' Microsoft tenants, including ConnectWise Cloud Backup, ConnectWise Cloud Management, and connected modules for Microsoft Teams, Exchange Online, SharePoint Online, Microsoft Graph, and Partner Center. It revoked certificates across all Cloud Backup users, suspending scheduled backups and blocking archive access and restores. The company says existing backup archives remain encrypted and isolated, with no evidence they were accessed, but it has not said when the services will return.
How the attackers got in
The attackers did not need to steal any individual customer's password. Instead, according to reporting on the compromised ConnectWise credential, they authenticated as the trusted application itself and requested Microsoft Entra ID access tokens directly, the same mechanism legitimate ConnectWise software uses to manage a client's cloud environment. That approach lets a single stolen credential unlock many customer tenants at once, rather than requiring attackers to phish or guess passwords one organization at a time. ConnectWise warned that disabling the connections does not undo changes already made inside a tenant, and that tokens issued before the shutdown may keep working until they expire on their own, which is why the company is urging customers to treat the shutdown as a starting point rather than a resolution.
Security firm Huntress, which investigates incidents on behalf of managed service providers, said sign-ins from the attackers' first IP address touched nearly 1,000 Entra tenants, with roughly 300 resulting in a successful token request. A second, more targeted wave on October 15 hit 16 organizations in the policy, national-security, trade, and critical-minerals sectors; Huntress said those specific attempts failed, and some were blocked by a missing service principal rather than any active defense. The firm traced the last confirmed malicious sign-in to 08:45 UTC that day, with manual follow-up activity continuing for several more hours afterward, and later linked two additional IP addresses to the same campaign.
What partners are being told to do
Because disabling the ConnectWise apps does not reverse any access already granted, Huntress and ConnectWise are telling partners to audit their own and their customers' tenants rather than assume the shutdown closed the exposure. Recommended steps include reviewing sign-in logs back to October 13, checking for dormant connections to the SkyKick migration tool, preserving audit logs before making further changes, and inspecting app credentials, consent grants, directory-role assignments, and mailbox-forwarding rules for anything added during the window. Possible follow-on moves by the intruders, according to the guidance, include granting the compromised app a Global Administrator role or adding credentials to other trusted applications to maintain access even after the original identity is cut off.
ConnectWise has not said how the application credentials were obtained in the first place, and it remains unclear whether a product flaw was involved or whether the keys were stolen through some other route entirely. That gap matters because ConnectWise's tools sit inside thousands of client networks simultaneously, meaning a single compromised vendor credential can functionally substitute for compromising hundreds of individual customers' own defenses. Cloud Backup, SaaS Security, and Cloud Management remain suspended for now, leaving an unknown number of managed-service-provider customers without working cloud backups until ConnectWise completes its review. The company has said only that its investigation is continuing and has not given a restoration date.
