Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
ConnectWise disabled customer access to its Cloud Backup service after attackers compromised application identities and used them to breach Microsoft 365 tenants. The incident is a supply-chain attack, meaning customers were exposed through their vendor, not through any action of their own.
Why this matters: This is why supply-chain attacks are so hard to defend against. You can do everything right on your own systems and still get hit because a vendor you rely on gets compromised. ConnectWise sold a backup product, which means the accounts affected were ones organizations trusted with sensitive data. The access point here was application identities, not passwords. That is a reminder that anything with credentials and permissions inside your Microsoft 365 environment is a target, whether or not a human being is on the other end.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.