ConnectWise-linked application identities reportedly compromised at least 162 Microsoft 365 tenants

Using backup-app identities with previously granted permissions

According to the report, attackers authenticated to Microsoft 365 as a backup application using its secret and could use permissions previously granted within customer tenants. Huntress identified at least 162 compromised tenants in its environment. The report says activity included attempts to assign directory roles and add credentials; Microsoft described the incident as an active supply-chain attack. ConnectWise said it had no indicators that partner backup data was compromised, while warning that separately established credentials, permissions, or access require review and remediation.

The available report does not provide a comparable prior count of affected Microsoft 365 tenants or a prior restoration timetable.

ConnectWise reportedly disabled seven implicated application identities and took Cloud Backup offline. Its October 18 update said scheduled backups, archive access, and restoration capabilities remained unavailable; SaaS Security and Cloud Management were also offline as a precaution.

The reported access path relied on an application identity with permissions already granted by customers rather than an interactive user sign-in. Disabling the implicated applications reportedly does not by itself remove credentials previously added in customer tenants, and previously issued access tokens may remain usable until they expire or are invalidated.