ConnectWise Suspends Cloud Backup After Compromise of Microsoft 365 Tenants

ConnectWise announced on Saturday that it has disabled seven application identities linked to its Cloud Backup service as part of an ongoing investigation into a breach that allowed unknown threat actors to gain unauthorized access to Microsoft 365 tenant data. The company said the compromise was discovered after anomalous activity was detected in the affected identities, leading to immediate suspension of the cloud backup function for those accounts.

The disabled identities include the ConnectWise Cloud Backup instance identified by the GUID 506e08f9-6e9a-4da4-942b-a099a03644ae, among others. While ConnectWise has not disclosed the full scope of the data accessed, it confirmed that the attackers leveraged compromised credentials to infiltrate Microsoft 365 environments that were linked to the backup service, potentially exposing email, files, and other corporate data stored in the cloud.

For Australian small and medium‑size enterprises that rely on ConnectWise or similar managed service provider (MSP) backup solutions, the incident highlights a supply‑chain risk that can affect even well‑known platforms. Many businesses in Darwin and across Australia outsource their IT and backup management to MSPs, meaning a breach at the provider level can quickly cascade to client environments if proper safeguards are not in place.

Experts advise organisations to verify that multi‑factor authentication (MFA) is enforced on all privileged accounts, to rotate service‑account passwords regularly, and to conduct independent backups that are not solely dependent on a single vendor. Companies should also request detailed incident reports from their MSPs, confirm that any compromised credentials have been revoked, and test restore procedures to ensure data integrity.

Staying vigilant about third‑party security incidents is essential for protecting business continuity. Australian businesses are encouraged to monitor updates from ConnectWise, review their own security policies, and consider diversifying backup strategies to mitigate the impact of future supply‑chain attacks.