ConnectWise Suspends Services After App Identity Breach

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after discovering that unknown attackers had obtained unauthorized access to seven of its application identities. The company detected the incident through internal monitoring on October 14. By October 17, ConnectWise had disabled the compromised identities and revoked certificates used for affected application connections across all users to remove its own access through those links.

Root cause

The compromise stemmed from stolen application credentials rather than individual customer passwords. ConnectWise applications already held permissions to access customer Microsoft 365 environments for managing services and running backups. Attackers obtained these shared application credentials, allowing them to impersonate ConnectWise’s own software. This enabled the threat actors to request access tokens from Microsoft Entra ID without needing to steal any customer login details.

Attack path

Once in possession of the stolen credentials, attackers used them to authenticate as legitimate ConnectWise applications. They requested access tokens from Microsoft Entra ID, bypassing standard user authentication requirements. Depending on the permissions originally granted to these applications, the attackers could access sensitive data within Microsoft 365 tenants. This included mailboxes, SharePoint documents, Teams messages, and directory data, exploiting the trust relationship between the vendor and its customers.

Affected versions

• ConnectWise Cloud Backup (formerly known as SkyKick)
• ConnectWise SaaS Security
• ConnectWise Cloud Management
• Microsoft 365 tenants using the above services

Mitigation

• ConnectWise revoked certificates used for affected application connections.
• Shared credentials previously used for Cloud Backup are no longer valid.
• The company disabled the seven compromised application identities.
• Internal security teams and a third-party incident response firm are monitoring the environment.

What it means for organisations

Organisations should immediately review third-party application permissions within their Microsoft 365 tenants. Security teams need to verify which vendors have active access and whether those credentials were shared across multiple clients. Incident response plans should address scenarios where a supplier’s application identity is compromised, as this bypasses user-level security controls. Leadership should be informed of the potential exposure of sensitive data, including emails and documents, to ensure proper communication and risk assessment.

Background: Cloud backup

Cloud backup copies data to a remote, isolated storage provider. It protects against hardware failure, accidental deletion, and ransomware. You configure automated snapshots of files and databases. This creates a separate copy that exists outside your primary network, allowing you to restore information if the original source becomes unavailable or corrupted.

Read the full guide: What Is Cloud Backup: Mechanics, Risks, and Recovery Strategy

What to do and how to stay safe: ConnectWise

• Audit all third-party application permissions in your Microsoft 365 admin center.
• Check for any unusual access patterns or token requests from known vendors.
• Monitor for alerts regarding compromised application identities from your suppliers.
• Prepare to revoke access for any vendor that confirms a credential breach.

Step-by-step guide: Identity and Access Management System: How It Controls Cloud Access

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers steal customer passwords in this incident?

No, attackers stole ConnectWise application credentials, not individual customer passwords.

Which ConnectWise services were suspended?

Cloud Backup, SaaS Security, and Cloud Management were taken offline.

How did ConnectWise discover the breach?

The company discovered the incident through internal monitoring on October 14.