ConnectWise Suspends Cloud Backup Service After Confirming Supply Chain Attack

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services entirely after confirming the credential-theft campaign CosmicBytez Labs has been tracking since October 17 amounts to a full supply chain attack on its Microsoft 365 integrations. This is an update to our prior coverage: October 17 — Hijacked ConnectWise Cloud Backup Credential Used to Breach 173 Microsoft 365 Tenants and October 18 — ConnectWise Disables Seven App Identities as Breach Scope Grows to Nearly 1,000 Tenants. ConnectWise said Friday, October 16 that it was investigating "attempts of unauthorized access associated with the ConnectWise Cloud Backup environment," and confirmed on Saturday, October 17 that the access had in fact occurred.

Details

Attribute	Value
Services suspended	Cloud Backup, SaaS Security, Cloud Management (the latter suspended "as a precaution")
Friday statement	ConnectWise disclosed it was investigating "attempts of unauthorized access" to the Cloud Backup environment
Saturday confirmation	ConnectWise confirmed the unauthorized access occurred
Credential actions taken Oct 17	Seven application identities disabled, connection certificates revoked, shared Cloud Backup credentials invalidated
Residual risk flagged by vendor	Access tokens issued before the shutdown "may remain usable until they expire or are otherwise invalidated"
Confirmed compromised tenants (Huntress)	At least 162 Microsoft 365 tenants, consistent with the ~173-tenant figure in prior reporting
Permissions abused (Microsoft assessment)	Attackers "likely abused existing permissions, including `Directory.ReadWrite.All`"
Customer impact disclosure	ConnectWise has not disclosed a total customer count publicly
Backup data status	Archives reported encrypted, isolated, and with no evidence of access
Restoration timeline	None announced as of October 19

What's New

A Full Service Suspension, Not Just Disabled Identities

Our October 18 coverage reported that ConnectWise had disabled seven Cloud Backup and Cloud Management application identities on October 17 at 07:00 UTC. The new development is that ConnectWise has gone further and suspended the underlying services outright: Cloud Backup itself, its SaaS Security monitoring and alerting product, and Cloud Management (which the company says was taken offline "as a precaution" due to its integration with Cloud Backup, not because it was independently confirmed compromised). Scheduled backups and restore capability remain unavailable for customers, and ConnectWise has not published a timeline for bringing any of the three services back online.

The Friday-to-Saturday Confirmation Window

ConnectWise's public language has moved through two distinct stages. On Friday, October 16, the company's security advisory characterized the situation cautiously, framing it as investigating "attempts of unauthorized access associated with the ConnectWise Cloud Backup environment" — language that left open the possibility the attempts had failed. By Saturday, October 17, that caveat was gone: ConnectWise confirmed the access had succeeded, aligning with the same day it disabled the seven application identities and revoked the associated certificates. That short window between "attempted" and "confirmed" reflects how quickly outside forensics support — engaged after ConnectWise identified compromised application identities internally on October 15 — closed the gap on what had actually happened inside customer tenants.

Microsoft's Permissions Assessment

Microsoft, which has corroborated the incident alongside Huntress and ConnectWise, assessed that the attackers "likely abused existing permissions, including Directory.ReadWrite.All" — a directory-wide read/write scope that goes well beyond what a backup tool needs to read mailbox and file content. Todyl's independent analysis of the same activity found the threat actor had gained "the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats" across affected tenants. Taken together, these assessments confirm that the compromised credential didn't just grant read access to back up customer data — it carried directory-level write permissions that could be used to create new privileged objects, consistent with the Global Administrator self-escalation and added application credentials Huntress documented in our prior coverage.

ConnectWise has reiterated that it does not have visibility into partner and customer tenant environments and, as a result, says it cannot independently determine how many organizations were actually breached versus merely touched by sign-in attempts. The company has declined to publish a total customer-impact figure in its public statements, leaving Huntress's tenant-level telemetry — at least 162 confirmed compromised tenants, consistent with the ~173-tenant and ~1,000-tenant-touched figures reported earlier — as the most concrete scope data available. ConnectWise has stated that it serves more than 100,000 managed service providers on its platform, underscoring how far a single vendor-side credential compromise can reach when services inherit customer-granted permissions at scale.

Tokens Already Issued May Still Work

ConnectWise's own advisory contains an important caveat for incident responders: disabling the seven application identities and invalidating shared credentials "severs authentication through the connections" going forward, but previously issued access tokens may remain usable until they expire or are otherwise invalidated. That means any token minted during the attackers' window of access — October 13–15 — could still function even after the service suspension, independent of whatever persistence (new application credentials, Global Admin role grants) attackers planted inside individual tenants.

Impact Assessment

Impact Area	Description
Service availability	Cloud Backup, SaaS Security, and Cloud Management are all suspended with no restoration date; MSPs have no scheduled backups, no restore capability, and no SaaS alerting from ConnectWise during the outage
Scope certainty	ConnectWise's lack of visibility into partner tenants means the true breached-customer count remains undetermined by the vendor; third-party telemetry (Huntress) is the primary source of scope data
Permission depth	`Directory.ReadWrite.All` abuse confirms the attackers held write access to directory objects, not just read access to backup content — enabling privilege escalation and persistence, not just data exposure
Residual token risk	Previously issued access tokens surviving the credential revocation represent an active risk window independent of the service suspension
Vendor-concentration risk	A single vendor-level compromise affecting a platform used by 100,000+ MSPs illustrates the blast radius of supply-chain attacks against shared-service providers

Recommendations

For MSPs and ConnectWise Cloud Backup Customers

Do not treat the service suspension as remediation of your own tenant. Continue auditing each tenant for application credentials, OAuth grants, mailbox rules, and directory role assignments created during the October 13–15 window, and specifically hunt for objects created via Directory.ReadWrite.All-scoped actions, such as new service principals or role assignments that didn't go through your normal change process. Because previously issued tokens can outlive the credential revocation, force a token refresh / revoke refresh tokens for the ConnectWise-related service principals in your tenant rather than assuming the vendor-side shutdown is sufficient. Secure alternate backup coverage now — there is no restoration timeline for Cloud Backup.

For Security Teams

Treat Directory.ReadWrite.All grants on any third-party application as a standing risk, not just in response to this incident. Review which applications in your tenant hold that scope, confirm it's actually required for the vendor's function, and where possible replace broad directory-write grants with narrower, task-specific permissions or conditional-access-scoped service accounts. Continue monitoring Microsoft Graph activity logs — not just Entra sign-in logs — for the application IDs documented in our October 17 coverage, since some attacker actions in this campaign reportedly leave no trace in standard sign-in logging.

For ConnectWise Partners Awaiting Service Restoration

Plan for an extended outage window. ConnectWise has given no date for restoring Cloud Backup, SaaS Security, or Cloud Management, and its own advisory language has consistently lagged the actual scope of the incident by a day or more at each stage of disclosure. Maintain independent monitoring of customer M365 environments while SaaS Security — ConnectWise's own alerting layer — is unavailable.

Key Takeaways

ConnectWise has suspended Cloud Backup, SaaS Security, and Cloud Management outright, beyond the seven application identities disabled on October 17 reported in our prior coverage.
ConnectWise's public disclosure moved from "attempts of unauthorized access" on Friday, October 16 to confirmed access on Saturday, October 17.
Microsoft assessed that attackers likely abused **Directory.ReadWrite.All**, a directory-wide write permission — confirming the campaign carried write, not just read, access across affected tenants.
ConnectWise says it lacks visibility into partner tenants and has not disclosed a total customer-impact count; Huntress's figure of at least 162 confirmed compromised tenants remains the most concrete scope data.
Access tokens issued before the October 17 shutdown may still be valid even though the underlying application identities are disabled — an active residual risk for affected tenants.
No restoration timeline has been announced for any of the three suspended services as of October 19.

ConnectWise Suspends Cloud Backup Service After Confirming Supply Chain Attack