ConnectWise shuts cloud backup after hackers breach Microsoft 365 tenants

ConnectWise has shut down customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, following a supply chain attack. BleepingComputer, The Hacker News, CyberSecurityNews, GBHackers News, and Cyber Press all report that hackers used compromised application credentials to gain unauthorized access to Microsoft 365 tenants. [1][2][3][4][5]

The Hacker News and CyberSecurityNews both report that unknown actors used the compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants. BleepingComputer reported that system administrators first observed unauthorized access to client data on Friday, noting a potential breach involving the backup service. [1][2][3]

The cybersecurity platform Huntress confirmed the unauthorized activity after detecting compromised environments, BleepingComputer reported. ConnectWise subsequently halted access to the cloud backup service to mitigate further unauthorized access across customer environments, GBHackers News and Cyber Press reported. [1][4][5]

Microsoft expanded into enterprise software and cloud services under executive leadership including chief executive officers Steve Ballmer and Satya Nadella. Enterprise cloud supply chains have faced increasing risks from malicious actors targeting third-party access, as FTMQ Security reported earlier. [9][10]