ConnectWise Halts Cloud Offerings After Credential Theft Hits Seven App Identities

Key points

• Unknown attackers compromised credentials tied to seven application identities at ConnectWise.
• ConnectWise suspended cloud services and took affected offerings offline after detecting the intrusion.
• Products in scope include Cloud Backup, SaaS Security, Cloud Management, and Microsoft 365 integrations.
• No CVE was assigned; the incident centers on stolen application credentials and tenant access.

ConnectWise handled a weekend security incident after an unidentified party obtained credentials linked to seven application identities. That credential theft enabled unauthorized entry into a tenant environment, according to the facts available. Once the vendor identified the intrusion, it halted hosted offerings and removed services from availability. The affected portfolio includes Cloud Backup, SaaS Security, Cloud Management, and integrations involving Microsoft 365.

The disruption affects ConnectWise customers who depend on those cloud-delivered tools, as well as downstream Microsoft 365 tenants connected through the platform. Seven application identities may sound like a narrow scope, but application credentials often carry broad permissions and can operate without interactive sign-in. A service suspension of this kind protects tenants from further unauthorized activity, yet it also interrupts backup, security, and management workflows that customers may rely on daily.

This case matters because it is not a patchable software flaw. No CVE was assigned, and the apparent vector was credential compromise rather than exploitation of a known vulnerability. Application identities are frequently overprivileged, long-lived, and less closely watched than user accounts. When attackers harvest those secrets, routine controls such as password resets or user MFA prompts may not stop access. The weekend timing also shortened the window for customers to notice and react before services went dark.

Severity is best treated as medium: the number of identities is limited and the vendor’s suspension likely contained the exposure, but tenant access and service outages raise supply-chain concerns for managed service providers and their clients. Organizations should watch for restored service notices, credential-rotation guidance, and any request to reauthorize integrations. Reviewing tenant audit logs, application consent records, and sign-in activity for the affected window will help determine whether downstream data was touched. The key question is whether the stolen application secrets were used only for initial access or for broader persistence before discovery.

What to do now

1. Rotate all secrets, keys, and certificates for application identities connected to ConnectWise and Microsoft 365, prioritizing the seven implicated identities.
2. Audit enterprise applications, service principals, and OAuth consent grants for unexpected permissions or newly added credentials.
3. Review Microsoft 365 unified audit logs and sign-in records for the weekend window, focusing on non-interactive and application-based access.
4. Apply least privilege to application identities and remove unused or overly broad permissions from cloud management, backup, and security integrations.
5. Enforce conditional access and workload identity protections where supported, and require strong credential storage and rotation policies.
6. Monitor ConnectWise advisories and status updates for service restoration, indicators of compromise, and required customer actions.
7. Preserve logs and prepare for forensic review if tenant access or data exposure is suspected, and notify affected stakeholders per policy.

Original source

Security Affairs