We need answer only headline <=90 chars, new factual, no five-word sequence external. Need craft. Facts: hackers breached ConnectWise? vendo

Key points

• Hackers compromised Microsoft 365 tenants connected to ConnectWise SkyKick Cloud Backup.
• They reached application identities and disrupted customers' ability to use the service.
• No CVE is tied to the event; severity is medium.

An intrusion affecting ConnectWise's SkyKick Cloud Backup for Microsoft 365 has left multiple tenants compromised, based on the facts available. The hackers did not exploit a published software flaw; no CVE has been linked to the event. Instead, they gained entry to tenant environments, reached application identities, and then terminated customers' ability to use the service.

Organizations that rely on SkyKick Cloud Backup to protect Microsoft 365 data are in scope, along with Microsoft as the platform vendor and ConnectWise as the product vendor. The impact is not limited to data exposure: application identity access can let an intruder act with the permissions granted to backup or automation apps. The shutdown of customer access adds operational disruption on top of the compromise.

Backup platforms are high-value targets because they often hold broad delegated permissions across mailboxes, files, and directory objects. If an application identity is abused, defenders may see legitimate-looking API traffic rather than obvious malware. The absence of a CVE means patching alone will not close the issue; identity, token, and configuration review are central.

The incident fits a broader pattern of identity-focused attacks against cloud service providers and their customers. Administrators should watch for unusual app registrations, consent grants, token issuance, and backup job changes. ConnectWise and Microsoft customers should expect further guidance and verify whether their tenants were touched. Severity is medium, but the combination of tenant compromise and access disruption warrants prompt review.

What to do now

1. Inventory every app registration and service principal tied to SkyKick Cloud Backup and Microsoft 365; remove unused or unknown entries.
2. Revoke active refresh tokens and sessions for suspicious backup or automation identities, then force reauthentication.
3. Rotate credentials, certificates, and client secrets used by backup applications; store them in a managed vault.
4. Review tenant audit logs for consent grants, role assignments, mailbox access, and backup configuration changes around the incident window.
5. Apply least privilege to backup app identities and restrict them to required scopes and mailboxes.
6. Enable MFA and conditional access for admin accounts; alert on new app registrations and high-risk sign-ins.
7. Notify affected customers and coordinate with ConnectWise and Microsoft support; preserve logs.

Original source

BleepingComputer