ConnectWise Suspends Cloud Backups Following Critical Supply Chain Cyberattack

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management platforms following a confirmed supply chain attack. Unauthorized actors leveraged compromised credentials to gain access to customer Microsoft 365 environments, utilizing elevated permissions to potentially modify directory roles and administrative settings.

Investigations indicate that attackers exploited the application's broad access to mail, files, and directory data to attempt unauthorized sign-ins across at least 162 customer tenants. While the company reports no evidence of backup data exfiltration, the incident highlights significant risks to managed service providers and their downstream clients.

ConnectWise has revoked affected application certificates and invalidated shared credentials to mitigate further unauthorized activity. However, the company lacks visibility into specific customer environments, preventing a definitive assessment of the scope of potential breaches. No timeline for service restoration has been established as forensic analysis and authentication monitoring continue.