ConnectWise App Identity Compromise Exposes Microsoft 365 Tenants to Data Breach
Stolen service credentials allowed attackers to bypass user passwords and access customer data, forcing ConnectWise to suspend cloud backup and management services.
Key points
- ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services after detecting unauthorized access to seven application identities.
- Attackers used stolen application credentials to request access tokens from Microsoft Entra ID, bypassing the need for customer passwords.
- The company revoked certificates for affected connections on October 17 and has not observed further successful threat activity since mitigation.
ConnectWise suspended its Cloud Backup service and took SaaS Security and Cloud Management offline after discovering that unknown attackers had obtained unauthorized access to seven of its application identities. The company identified the incident through internal monitoring on October 14 and disabled the compromised identities by October 17, according to Security Affairs. This action removed ConnectWise’s access through those specific connections and invalidated the shared credentials previously used for the backup service.
The risk
The breach did not involve the theft of individual customer passwords. Instead, attackers exploited the permissions already granted to ConnectWise applications for managing services and running backups. By stealing these application credentials, the threat actors could impersonate ConnectWise’s own software and request access tokens from Microsoft Entra ID. This method allowed them to bypass standard password protections entirely, as the authentication was handled at the application level rather than the user level.
Who is exposed
Customers using ConnectWise Cloud Backup, formerly known as SkyKick, are directly affected by this incident. Because the compromised identities held permissions to access Microsoft 365 environments, attackers could potentially reach mailboxes, SharePoint documents, Teams messages, and directory data. ConnectWise stated that, at the time of the alert, there was no indication that any other product, service, or offering was impacted by the unauthorized access to these specific application identities.
Cost and compliance
ConnectWise engaged a third-party incident response firm to support its investigation and containment efforts. The company’s internal security teams and Security Operations Center are actively monitoring the backup infrastructure and broader environment. The investigation extends across all partner-facing services to ensure comprehensive containment. ConnectWise reported that it has not observed successful threat activity in the environments it monitors since implementing the described mitigations on October 17.
What to watch
Security teams should verify whether their Microsoft 365 tenants were connected to ConnectWise Cloud Backup during the exposure window. Organizations must review application permissions in Entra ID to ensure no unauthorized service principals retain access. Monitoring for unusual token requests from known service accounts is critical, as attackers may attempt to reuse compromised credentials before they are fully revoked.
Signals worth monitoring
Teams usually detect this activity by reviewing audit logs for unexpected access tokens issued to service principals. Check whether application identities are accessing resources outside their normal operational patterns or geographic locations. Look for spikes in data export events from SharePoint or Exchange Online triggered by service accounts. First containment moves involve immediately revoking the specific application credentials and resetting associated certificates. Disable the affected service principal in the identity provider to stop further token issuance while the investigation continues.
What to do and how to stay safe: ConnectWise
- Review Microsoft 365 admin centers to identify any active connections to ConnectWise Cloud Backup or SkyKick services.
- Audit application permissions in Entra ID to ensure service principals have only the minimum necessary access rights.
- Monitor sign-in logs for unusual activity from service accounts, particularly token requests from unexpected locations or times.
- Verify with your provider that any shared credentials or certificates associated with their services have been rotated or revoked.
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did attackers steal customer passwords in this breach?
No, attackers stole ConnectWise application credentials, which allowed them to bypass password protections by impersonating the service.
Which ConnectWise services were suspended?
ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services following the discovery of the compromised identities.
Is there a patch for this vulnerability?
The company revoked the compromised certificates and disabled the affected identities, effectively removing the attackers' access through those channels.
