ConnectWise Halts Cloud Backup Service After Supply‑Chain Attack Compromises Microsoft 365 Tenants

ConnectWise said it would promptly discontinue its Cloud Backup offering—previously called SkyKick Cloud Backup—after a supply‑chain breach enabled threat actors to seize application identities and infiltrate customers' Microsoft 365 setups.

The firm explained that the perpetrators exploited a tainted element in ConnectWise’s software delivery chain, embedding malicious code that activated whenever the backup tool interacted with Microsoft 365 APIs. This intrusion let the attackers pose as authentic service accounts, allowing them to list and, in certain instances, alter data within the compromised tenants.

Serving as a productivity backbone for millions of enterprises globally, Microsoft 365’s tenant environment is highly sensitive, and any illicit access sparks serious worries about data confidentiality, integrity and operational continuity. Analysts point out that supply‑chain assaults—where the adversary compromises a trusted supplier instead of the final user—are particularly dangerous, as they sidestep many conventional perimeter safeguards.

To contain the breach while a forensic review proceeds, ConnectWise opted to suspend the Cloud Backup service. The company has advised its clients to inspect Microsoft 365 audit logs, rotate service‑account passwords, and activate multi‑factor authentication wherever feasible. It has not provided a public figure for the affected tenants, nor confirmed whether any data was stolen.

The episode serves as a cautionary tale that third‑party integrations may represent the most vulnerable point in a cloud‑first architecture. Specialists counsel firms to implement zero‑trust principles, restrict service‑account privileges, and maintain ongoing surveillance for irregular behavior, particularly when external tools are employed.

Microsoft confirmed collaboration with ConnectWise and law‑enforcement agencies to gauge the breach’s extent. The software giant also urged its users to maintain current security settings and to implement suggested hardening steps for Azure AD and Microsoft 365. Both companies pledged to release additional information as the inquiry progresses.