ConnectWise Disables Cloud Backup After Supply‑Chain Breach Hits Microsoft 365 Tenants

ConnectWise announced the immediate suspension of its Cloud Backup service, formerly known as SkyKick Cloud Backup, following a supply‑chain intrusion that allowed threat actors to hijack application identities and gain access to customers' Microsoft 365 environments.

According to the company, the attackers leveraged a compromised component within ConnectWise's software delivery pipeline, inserting malicious code that surfaced when the backup solution communicated with Microsoft 365 APIs. The breach enabled the intruders to impersonate legitimate service accounts, granting them the ability to enumerate and, in some cases, modify data across affected tenants.

Microsoft 365 is a cornerstone of productivity for millions of organizations worldwide, and any unauthorized entry into its tenant infrastructure raises significant concerns about data confidentiality, integrity, and business continuity. Security analysts note that supply‑chain attacks—where the attacker targets a trusted vendor rather than the end user directly—are especially potent because they bypass many traditional perimeter defenses.

ConnectWise's decision to shut down the Cloud Backup service was taken to contain the incident while it conducts a forensic investigation. The firm has urged customers to review their Microsoft 365 audit logs, rotate service‑account credentials, and enable multi‑factor authentication where possible. No public estimate of the number of compromised tenants has been released, and the company has not disclosed whether any data was exfiltrated.

Industry observers point to the incident as a reminder that third‑party integrations can become the weakest link in a cloud‑centric ecosystem. Experts recommend that organizations adopt a zero‑trust approach, limiting the permissions of service accounts and continuously monitoring for anomalous activity, especially when third‑party tools are involved.

Microsoft has confirmed that it is working with ConnectWise and law‑enforcement partners to assess the scope of the breach. The tech giant has also reminded customers to keep their security configurations up to date and to apply recommended hardening measures for Azure AD and Microsoft 365. As investigations continue, both firms say they will provide further updates as more details become available.