ConnectWise Cloud Backup breach compromises 160+ Microsoft 365 tenants

ConnectWise shut down its Cloud Backup service on October 17 after security researchers confirmed that attackers had compromised the platform's application credentials and used them to access customer Microsoft 365 environments. The service, which ConnectWise acquired from SkyKick, holds broad OAuth permissions across managed tenants by design — and that reach is exactly what made this breach damaging.

Security firm Huntress identified at least 162 compromised tenants in its own monitoring environment. Because ConnectWise Cloud Backup authenticates as an application rather than a user, multi-factor authentication never applied. The attacker used a scripted sign-in tool to authenticate directly with the stolen app secret, gaining the technical ability to read and write mail, SharePoint files, OneDrive data, and Teams chats across every tenant where the credentials worked.

Malicious activity began at least October 13, with scripted attempts originating from IP address 144.172.64[.]128. Todyl analyzed nine intrusions and found only sign-in activity — no file creation, account persistence, or lateral movement through those specific tenants. However, Microsoft confirmed the activity and noted the attacker likely abused Directory.ReadWrite.All permissions. In at least one tenant, a Cloud Management app was used to grant itself Global Administrator and add credentials to other tools.

ConnectWise took the service offline at 05:01 UTC on October 17 and has not provided a restoration timeline. The company said existing backup archives are unaffected and there is no indication that partner backup data was compromised — though the full extent of data access across all affected tenants remains unclear.

Managed service providers using ConnectWise Cloud Backup or Cloud Management should audit Entra ID service principal sign-in logs immediately, filtering by app ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Disabling the application stops new tokens but does not invalidate existing ones — revoking user sessions will not end application-level access. Administrators should also look for credential or OAuth grant changes since October 13 and review user agents including python-urllib/3.12 and python-requests/2.31.

The attack follows a pattern of threat actors targeting backup and management platforms because they carry persistent, privileged credentials by design. An MSP tool that can touch every tenant it manages is a single point of catastrophic failure if its credentials leak — and this incident makes that risk concrete.

As first reported by BleepingComputer, with additional analysis from Huntress and Todyl.