ConnectWise disables services after M365 credential compromise

ConnectWise, a software platform serving managed service providers (MSPs), suspended three critical services after detecting unauthorised access to application identities within its Cloud Backup environment. The company identified the issue on 14 October 2026 through its advanced cybersecurity monitoring and diligence. On 17 October 2026 at 07:00 UTC, ConnectWise disabled seven application identities and revoked certificates used for affected application connections. As of 16:00 UTC on 18 October, Cloud Backup (formerly known as SkyKick), SaaS Security and Cloud Management remain unavailable.

The incident exposes a structural vulnerability in how enterprise software supply chains operate.

The sequence of events

ConnectWise published an advisory on 16 October revealing that on 15 October it had identified unauthorised access to application identities within the Cloud Backup environment. The company stated that Cloud Backup is used to back up data stored on-premises, in the cloud, or in SaaS services like Microsoft 365 and Google Workspace.

Because SaaS Security and Cloud Management are integrated with Cloud Backup, those services were also suspended out of an abundance of caution. ConnectWise suspended the services by revoking certificates used for affected application connections. The company noted that disabling affected connections prevents new authentication through those connections but does not reverse changes previously made inside a tenant.

ConnectWise stated that existing archives remain encrypted, isolated and preserved, with no evidence of unauthorised access. The suspension does not mean MSPs or their customers should assume their environments were compromised, only that ConnectWise is unable to operate its services safely during its investigation and remediation.

What security researchers found

Security firm Huntress confirmed that a Microsoft 365 credential belonging to ConnectWise Cloud Backup had been compromised and was being used to gain unauthorised access to customers' M365 environments. Huntress identified a second ConnectWise application, ConnectWise Cloud Management for Microsoft Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640), which gave itself Global Administrator privileges and then added new credentials to two other applications within one affected tenant.

Huntress warned that disabling M365 applications will not remove credentials that were already added. The firm explicitly advised: "You must review the credentials on all of your M365 applications."

What remains unknown

ConnectWise has not disclosed whether a product vulnerability contributed to the compromise of the application identities. The company states that the exact credential-exposure mechanism is the subject of ongoing analysis.

The company has not disclosed the full scope of the incident, the number of affected customers, or how much data is stored in the compromised service. ConnectWise provided only indicators of compromise tied to a handful of IP addresses and stated it "cannot discuss threat actor attribution at this time."

ConnectWise's customer relationships are entirely mediated through MSPs. An organisation that buys backup services from an MSP may have no contractual relationship with ConnectWise, no visibility into the platforms used for service delivery, and no direct channel to receive security information.

The supply chain risk

Software platforms serving the MSP sector are attractive targets precisely because a single compromise can affect many organisations at once.

ConnectWise has called on its customers to probe any M365 environments they manage for signs of compromise. This places the burden of discovery on MSPs, who must then communicate with their end-user customers. However, ConnectWise has no knowledge of those downstream setups.

What this means for IT teams

For managed service providers, this incident creates immediate operational pressure.

For end-user organisations, the problem is more acute. Organisations relying on an MSP that uses ConnectWise Cloud Backup cannot perform backups or restores, yet they may be unaware that their chosen service provider depends on this platform.

Security teams should immediately audit all Microsoft 365 applications and service principals for unauthorised credentials or Global Administrator grants, particularly if backup or management services are provided by an external MSP. This includes reviewing:

• Application credentials and secrets added in recent weeks
• Recent changes to application role assignments, especially Global Administrator grants
• Audit logs for M365 applications created or modified by unfamiliar service principals

Organisations should conduct a broader application audit rather than rely on known indicators of compromise alone.

Remediation and persistence

The attack pattern is particularly dangerous because adding credentials to applications within a tenant establishes persistence. Even if the original compromised credential is revoked, the newly added credentials provide an alternative means to regain access to the compromised environment.

ConnectWise has disabled integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products. However, the company noted that previously issued access tokens may remain usable until they expire or are otherwise invalidated.

Key takeaways

The immediate risk is operational: customers cannot access their backup archives during the suspension. The secondary risk is that compromised credentials may have been used to establish persistence within customer M365 environments. The structural risk is that end-user organisations often have no knowledge of the software platforms used to deliver their services and no direct notification channels when those platforms are compromised.

The incident underscores why IT teams need to know not just which services they contract for, but which platforms and vendors sit between them and those services. Without that visibility, organisations cannot assess their own risk exposure when a supplier's security fails.