ConnectWise disabled seven application identities on Saturday after discovering that unknown threat actors obtained unauthorized access to the identities and compromised Microsoft 365 tenants. The company continued its investigation into the incident involving the compromised credentials.
ConnectWise Cloud Backup, identified by application identity 506e08f9-6e9a-4da4-942b-a099a03644ae, was among the disabled services. The company took action to prevent further unauthorized access through the compromised identities.
The incident demonstrates a supply chain risk affecting organizations using ConnectWise services. Microsoft 365 environments connected through ConnectWise applications faced exposure when threat actors exploited the compromised identities. Organizations relying on ConnectWise Cloud Backup and related services experienced service disruption as the company implemented protective measures.
ConnectWise did not immediately provide details on the scope of affected customers, the methods used to compromise the application identities, or a timeline for service restoration. The company's response focused on disabling the compromised identities to prevent further tenant compromise while investigation continued.
Microsoft 365 administrators using ConnectWise integrated services needed to assess whether their tenants were affected by the compromise. The incident highlighted the importance of monitoring application identity usage and implementing strong authentication controls for third-party integrations connecting to Microsoft 365 environments.