ConnectWise pulled the plug on its Cloud Backup service on Saturday after intruders who took over seven of the vendor’s application identities signed into customer Microsoft 365 tenants, the company said in an advisory update.
The identities tied to Cloud Backup, Teams, Exchange Online, SharePoint Online and Microsoft Graph were disabled at 07:00 UTC on October 17. The company also revoked the certificates behind the shared Cloud Backup connections, and said previously issued tokens may keep working until they time out.
Deeper trouble comes from how the intrusion works. Anyone holding an application credential can ask Entra ID for tokens matching the permissions already granted, so mailboxes, Teams chats, SharePoint documents and directory records open up without a single stolen user password. ConnectWise warned that cutting the connections stops fresh logins but leaves any backdoors planted earlier untouched.
Two days between discovery and shutdown
The company says monitoring flagged the problem on October 14. Scheduled backups have stopped, restores are unavailable, and SaaS Security plus Cloud Management went dark while the review runs. Archived data stays encrypted and isolated, with no sign the attackers reached it.
How the credentials leaked is still unknown, and ConnectWise has not ruled out a product flaw. Managed service providers running the backup stack should audit every OAuth grant on their tenants, rotate application secrets, and hunt for token use no human initiated.
