ConnectWise Halts Cloud Backup Service After Supply‑Chain Attack Compromises Microsoft 365 Tenants

ConnectWise said it would promptly cease operations of its Cloud Backup offering—previously called SkyKick Cloud Backup—after a supply‑chain breach let attackers seize application identities and infiltrate clients' Microsoft 365 setups.

The firm explained that the perpetrators exploited a tainted element of ConnectWise's software distribution chain, embedding malicious code that activated during the backup tool's interaction with Microsoft 365 APIs. This compromise let the attackers masquerade as authentic service accounts, allowing them to list and, in certain instances, alter data within the impacted tenants.

Serving as a productivity backbone for millions of enterprises globally, Microsoft 365's tenant infrastructure being accessed without permission sparks serious worries over data confidentiality, integrity and operational continuity. Analysts point out that supply‑chain assaults—where the adversary compromises a trusted supplier instead of the final user—are particularly effective, as they sidestep numerous conventional perimeter safeguards.

To contain the situation while a forensic inquiry proceeds, ConnectWise opted to disable the Cloud Backup service. The company has advised its clients to examine Microsoft 365 audit logs, rotate credentials for service accounts, and activate multi‑factor authentication wherever feasible. It has not provided a public figure for the compromised tenants, nor confirmed if any data was stolen.

The episode serves as a caution that third‑party integrations may represent the most vulnerable point in a cloud‑first environment, according to industry watchers. Specialists suggest firms implement a zero‑trust model, restrict service‑account privileges, and maintain ongoing surveillance for irregular behavior, particularly when external tools are employed.

Microsoft confirmed collaboration with ConnectWise and law‑enforcement agencies to evaluate the breach’s extent. The software giant also urged its users to maintain current security settings and implement advised hardening steps for Azure AD and Microsoft 365. As the probe proceeds, both companies pledge to issue additional updates when further information emerges.