Threat intel
ConnectWise Disables Cloud Backups Over Concerns for Downstream MSPs
ConnectWise has disabled its cloud backups amid concerns for downstream managed service providers, after researchers said attackers authenticated into Microsoft 365 tenants using ConnectWise credentials, according to Dark Reading. ConnectWise says customer impact remains unconfirmed.
ConnectWise has disabled its cloud backups amid concerns about potential risk to downstream managed service providers (MSPs), according to a report by Dark Reading.
Researchers cited in the report said attackers authenticated into Microsoft 365 tenants using ConnectWise credentials. ConnectWise, however, said that customer impact remains unconfirmed, meaning the company has not yet verified whether any customers were directly affected by the reported activity.
The decision to disable cloud backups appears to be a precautionary step while the situation is assessed. Details about the scope of the incident — including how the credentials may have been abused, how many tenants were involved, and whether any data was accessed or stolen — were not provided in the report.
The case highlights the supply chain risks tied to MSP-focused software and service providers. Because MSPs manage IT environments for many downstream clients, a compromise involving an MSP platform or its credentials can potentially expose a large number of organizations at once. Microsoft 365 tenants are also a frequent target for attackers seeking email access, data theft, or a foothold for follow-on attacks such as business email compromise.
Dark Reading reported that ConnectWise's position is that customer impact has not been confirmed, and the situation may evolve as the investigation continues. MSPs and their clients relying on ConnectWise services will likely be watching for further guidance from the company.
Source: Dark Reading
