ConnectWise Disables Identities After Microsoft 365 Breach
Attackers exploited ConnectWise application identities to compromise Microsoft 365 tenants. The company has suspended its cloud backup service and disabled several identities during the investigation.
TL;DR
- ConnectWise disables seven application identities after a security breach.
- Attackers gained unauthorized access to Microsoft 365 tenants through compromised identities.
- Cloud backup services have been temporarily suspended.
- Investigation is ongoing; customers are advised to monitor their environments.
- Organizations using ConnectWise integrations should review permissions and activity logs.
ConnectWise has taken emergency action to disable seven of its application identities following a security incident that led to unauthorized access to Microsoft 365 tenants. The breach, attributed to unknown threat actors, exploited these identities to gain entry into customer environments.
In response, the company has paused its cloud backup offerings and initiated a full investigation. Customers are being urged to remain vigilant and assess their systems for unusual activity while remediation efforts continue.
What Happened
- Threat actors obtained unauthorized access to ConnectWise application identities.
- These identities were used to infiltrate Microsoft 365 tenant environments.
- Seven specific application identities have been disabled by ConnectWise.
- One impacted service includes ConnectWise Cloud Backup.
Impact and Response
- Customers' Microsoft 365 data may have been exposed or manipulated.
- ConnectWise has suspended its cloud backup functionality indefinitely.
- An internal investigation is underway to determine the scope and cause.
- Affected organizations should audit identity permissions and user activity logs.
- No evidence yet suggests data was exfiltrated, but monitoring is recommended.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.