Hackers breach Microsoft 365 via ConnectWise supply‑chain attack

Hackers accessed application identities in ConnectWise’s Cloud Backup service and used them to infiltrate Microsoft 365 tenant accounts, according to a recent security report. The breach forced ConnectWise to shut down customer access to the service while it investigates the incident.

ConnectWise, previously known as SkyKick Cloud Backup, provides backup and recovery tools for Microsoft 365. Attackers reportedly stole credentials that allowed them to impersonate legitimate applications within customers’ Microsoft environments. By doing so, they could read email, files, and other data stored in compromised Microsoft 365 tenants.

The affected parties are customers of ConnectWise’s Cloud Backup service, many of whom run Microsoft 365 for business communications and document storage. The attack leverages a supply‑chain method, where the malicious actors compromise a trusted third‑party provider to reach downstream victims. This approach bypasses many traditional defenses that focus on direct attacks against end users.

To limit damage, ConnectWise disabled the Cloud Backup service for all customers while it resets affected credentials and reviews its security controls. The company is working with Microsoft to remediate the issue and has advised customers to monitor their accounts for unusual activity.

Readers can protect themselves by reviewing recent sign‑in activity in Microsoft 365 and revoking any unknown application permissions. Changing passwords for Microsoft accounts and enabling multi‑factor authentication (MFA) adds an extra layer of defense. It is also wise to run a password strength check using the free tools available at ComputerScams.com to ensure new passwords meet security best practices.

Free tools on ComputerScams.com, such as the Email Scam Checker, the Website Checker and the Password Breach Checker, can help you check suspicious messages, links and passwords. Regularly reviewing account activity and keeping MFA enabled are simple steps that can stop attackers from moving laterally within your environment.

Stay vigilant and act quickly if you notice anything out of the ordinary. A practical safety tip: enable multi‑factor authentication on all critical accounts today.

Source: Read the original report