Thousands of managed service providers lost the ability to back up or restore customer data when ConnectWise suspended Cloud Backup, along with the SaaS Security and Cloud Management tools wired into it.
The chain of events starts with a credential the vendor itself held. ConnectWise detected unauthorized access to application identities inside the Cloud Backup environment on October 15. That identity is what the backup service uses to request Microsoft Graph tokens in customer tenants, so a stolen copy lets an attacker authenticate as the application rather than as a person.
Huntress spotted the resulting sign-ins and by 19:00 UTC on October 16 had logged them across 162 tenants. The requests arrived from 144.172.64[.]128 between 06:13 and 08:34 UTC, an address belonging to a hosting provider rather than the Azure range the service normally used. Two more were added to the advisory on October 19.
The mechanics explain why nobody noticed quickly. Application authentication skips the password prompt and the MFA challenge that a human login triggers, and the credential lived in ConnectWise’s own environment, so no customer action could have produced it.
ConnectWise disabled seven application identities on October 17 and cut integrations with Exchange, Teams, SharePoint Online and its own products. By the October 19 update it reported no successful activity in monitored environments since containment, with archives still encrypted and isolated, but no restoration timeline.
Partners should revoke stale OAuth grants for backup and management apps, review sign-in logs for application authentications from unfamiliar hosting ranges, and confirm which credentials their own technicians still hold.
