ConnectWise Shuts Cloud Backup After Credential Attack in MSP Channel

En bref

• ConnectWise disabled its Cloud Backup product after detecting credential-based intrusion.
• The service supports Microsoft 365 backups for MSPs that resell or manage it.
• Customer effects and risk to tenant access are not yet verified.
• The probe continues; no CVE has been linked to the event.

ConnectWise has taken its Cloud Backup service offline after discovering that unknown parties gained access through login credentials rather than a software flaw. The company is investigating whether the intrusion created exposure for Microsoft 365 tenants whose backups run through the product. No CVE has been assigned, and the vendor has not confirmed any customer-level impact.

The disruption matters most to managed service providers that rely on ConnectWise Cloud Backup to protect Microsoft 365 data for their own clients. Because those providers sit downstream from the vendor, a backup service outage can ripple across many small and mid-sized organizations that may not know their provider uses this platform. For K-12 and government entities, the concern is twofold: interrupted backup coverage and the possibility that credentials tied to tenant access were mishandled.

At this stage, the confirmed operational fact is that cloud backups were disabled. The open questions are whether attackers reached tenant data, whether credentials were used only for the backup platform, and how long restoration will take. ConnectWise says its investigation is still active. The absence of a CVE suggests the incident is being treated as an identity or access problem, not a known product vulnerability.

Administrators should treat this as a supply-chain visibility problem. Identify which Microsoft 365 tenants depend on ConnectWise Cloud Backup, review sign-in and audit records for unusual activity, and confirm that alternate restore paths exist. Watch for updated guidance from ConnectWise and from the MSPs that manage affected environments. If credentials were shared across backup and administrative roles, rotate them and tighten access before backups resume.

À faire maintenant

1. Inventory every Microsoft 365 tenant backed up through ConnectWise Cloud Backup, including clients managed by downstream MSPs.
2. Rotate credentials, API keys, and service-account secrets tied to ConnectWise integrations and Microsoft 365 administration; enforce MFA where possible.
3. Review Microsoft 365 audit logs for anomalous sign-ins, mailbox rule changes, OAuth consent grants, and privileged role assignments.
4. Test alternate restore procedures and verify backup integrity for critical data before the service is re-enabled.
5. Contact ConnectWise and your MSP for status updates, indicators of compromise, and restoration timelines; preserve relevant logs.
6. Apply least privilege and conditional access to backup and tenant-administration accounts, separating duties where feasible.

Source originale

Dark Reading