Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
BLUF
A ConnectWise Cloud Backup supply-chain attack has exposed Microsoft 365 tenants through compromised application identities.
NEWS
ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers accessed application identities. The breach allowed hackers to move into affected Microsoft 365 environments, creating a supply-chain risk for organizations relying on the service.
Why I Care
This matters because trusted backup and SaaS integrations can become entry points into core productivity platforms. Organizations using ConnectWise Cloud Backup or related Microsoft 365 integrations may face data exposure, account takeover, persistence, and lateral movement risks.
Next Steps
IT security teams should immediately review Microsoft 365 OAuth consent grants, application permissions, sign-in logs, and service principals tied to ConnectWise/SkyKick. Rotate or revoke suspicious app credentials, enforce MFA and conditional access, isolate affected tenants if needed, and investigate for persistence or data exfiltration.
Source: BleepingComputer ·