Hackers Exploit ConnectWise Credential to Access 173 M365 Tenants

Hackers have leveraged a compromised ConnectWise Cloud Backup credential to log into 173 Microsoft 365 (M365) tenant accounts, according to a recent security report. The attackers used the stolen login to gain unauthorized access to the affected organizations’ email and collaboration services.

ConnectWise Cloud Backup, previously known as SkyKick, provides cloud‑based backup and recovery for managed service providers (MSPs). The breach appears to involve a single set of credentials that gave the threat actors the ability to sign in to multiple M365 tenants that rely on ConnectWise for data protection. Researchers observed that the compromised account was used to pull data from the tenants and to explore the environments, indicating a focused intrusion rather than a random scan.

The victims are primarily businesses that use ConnectWise Cloud Backup to safeguard their Microsoft 365 data. By accessing the backup service account, the attackers could reach the underlying M365 tenant, potentially viewing email, files, and other sensitive information. The report does not specify any ransom demands, but the exposure of corporate communications and documents poses a serious risk of data leakage and further phishing attacks.

To protect against this type of intrusion, users should immediately change passwords for any ConnectWise and Microsoft 365 accounts, especially if the same credentials were reused elsewhere. Enabling multi‑factor authentication (MFA) on both services adds a critical layer of defense, as it requires a second verification step beyond the password. Regularly reviewing login activity in Microsoft 365 can help spot unfamiliar sign‑ins, and disabling legacy authentication protocols reduces the attack surface.

Free tools on ComputerScams.com, such as the Email Scam Checker, the Website Checker and the Password Breach Checker, can help you check suspicious messages, links and passwords. Running the password breach checker and the password strength checker can quickly reveal whether your credentials may have been exposed and guide you to create more secure passwords.

The incident underscores the importance of treating backup service credentials with the same rigor as primary account logins. Organizations should enforce strong, unique passwords for every service and ensure that MFA is turned on wherever possible. Promptly reviewing and revoking any unused or stale service accounts further limits opportunities for attackers.

A practical step you can take right now is to log into your Microsoft 365 admin portal, verify that MFA is active for all users, and review recent sign‑in logs for any unfamiliar locations or devices.

Source: Read the original report