ConnectWise has suspended its Cloud Backup, SaaS Security and Cloud Management services after a compromised credential was used to reach customers' Microsoft 365 tenants. For UK MSPs and their clients, the incident is a sharp lesson in what backup and disaster recovery tooling actually touches inside a tenant.
View the data behind this chart
| Oct 13-14 | Oct 15 | Total tenants | |
|---|---|---|---|
| Impacted systems | orgs4 | orgs50 | orgs162 |
What ConnectWise has confirmed
ConnectWise said on Friday it was investigating unauthorised access attempts linked to its Cloud Backup environment, and confirmed the access the following day. Incident responders at Huntress identified that a credential belonging to ConnectWise Cloud Backup had been stolen and used to reach customers' Microsoft 365 environments. Microsoft separately confirmed that attackers "likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All."
ConnectWise has revoked the certificates tied to affected application connections and says all shared credentials previously used for Cloud Backup are no longer valid. A company spokesperson told Recorded Future News there is "no indication" that backup data itself was compromised, but admitted ConnectWise has no visibility into partner and customer environments, meaning it cannot say whether any individual tenant was breached. There is currently no timeline for restoring the affected services.
Why this is an M365 permissions story, not just a backup outage
The detail that should concern UK buyers most is not the service suspension — it is what the stolen credential could reach. ConnectWise Cloud Backup, like most M365 and Google Workspace backup connectors, needs broad access to mailboxes, OneDrive, SharePoint and Teams data to do its job. Huntress warned that once an application can assign directory roles, it can make itself a Global Administrator, then reset passwords, change Conditional Access policies, and plant new credentials and applications that give attackers a way back in that no longer depends on the original vendor credential.
That escalation path is exactly what organisations evaluating backup tooling need to compare Microsoft 365 backup solutions against: not just recovery performance, but how much standing privilege the vendor's connector holds inside a tenant, and how that access is scoped and monitored.
The scale and shape of the attack
Huntress traced the first wave to password spray attempts against four law firms on 13 and 14 October. By 15 October, around 50 monitored systems saw attackers use ConnectWise's Cloud Management apps to grant themselves directory or administrative roles, and unauthorised sign-ins were ultimately observed across 162 tenants. A second, largely unsuccessful wave specifically targeted organisations in policy, national security, trade and critical mineral sectors — most of which, Huntress noted, did not even use ConnectWise products, meaning the attempts failed simply because the relevant application was not present.
For MSPs specifically, Huntress flagged the worst-case scenario: a single compromised vendor credential giving an attacker a foothold that can be pivoted from one customer tenant into every other customer the MSP manages.
What this means for UK MSPs and their clients
Any UK managed service provider running ConnectWise Cloud Backup, SaaS Security or Cloud Management should treat this as an active incident requiring tenant-level verification, not a vendor problem that will resolve itself once services resume. That means reviewing Entra ID audit logs for unexpected role assignments, new application registrations, altered Conditional Access policies and password resets going back to mid-October — the exact behaviours Huntress documented.
This is also a timely prompt to conduct a thorough supplier cyber risk assessment across every third-party application with standing M365 permissions, not just backup vendors. ConnectWise has had previous security incidents, including a nation-state attack on its remote monitoring and management software last year and earlier exploited vulnerabilities that led to ransomware, so this is not an isolated event for the vendor.
Hardening the backup layer against vendor compromise
The core lesson for buyers is that rotating a compromised vendor credential is necessary but not sufficient once an attacker has used it to create new persistence. UK organisations should use this moment to enhance their cloud security posture around every connected application, reviewing exactly what scopes and roles each backup or management tool actually requires versus what it has been granted.
It is also worth revisiting backup architecture itself. Teams should learn about immutable backups so that even if a connector's credentials are compromised, stored recovery points cannot be altered or deleted by an attacker who gains administrative access through that same connector. Platforms built on Veeam with separated access controls are one way organisations are reducing this single-point-of-failure risk, and modelling the potential cost of an extended outage with a downtime cost calculator can help justify the investment in stronger separation to the board.
View the data behind this chart
| Layer | Detail |
|---|---|
| Vendor credential stolen | ConnectWise Cloud Backup app credential compromised |
| Elevated Graph permissions abused | Directory.ReadWrite.All used against tenant |
| Self-assigned admin roles | Attacker becomes Global Administrator in tenant |
| New persistence planted | New apps, credentials and Conditional Access changes added |
What to check this week
With no restoration timeline confirmed, UK buyers should not wait for ConnectWise to finish its forensic review before acting on their own tenants.
It is also worth revisiting backup architecture itself. Teams should learn about immutable backups so that even if a connector's credentials are compromised, stored recovery points cannot be altered or deleted by an attacker who gains administrative access through that same connector. Platforms with separated access controls are one way organisations are reducing this single-point-of-failure risk, and modelling the potential cost of an extended outage with a downtime cost calculator can help justify the investment in stronger separation to the board.
- •Search Entra ID sign-in and audit logs for activity since 13 October, focusing on new directory role assignments and application registrations
- •Confirm whether your organisation or MSP uses ConnectWise Cloud Backup, SaaS Security or Cloud Management, even indirectly via a supplier
- •Review which third-party applications currently hold Directory.ReadWrite.All or similarly elevated Graph API permissions in your tenant
- •Ask your MSP directly whether they have confirmed zero unauthorised access across all client tenants, not just their own