ConnectWise Shuts Down Cloud Backup After Microsoft 365 Breach

Michael Miller · 2026-10-18

So, ConnectWise just dropped some news that's making waves in the IT world. On Saturday, they announced they've disabled seven ConnectWise application identities. Why? Because unknown threat actors got unauthorized access to those identities and compromised Microsoft 365 tenants. Yeah, that's a big deal. Let me break it down. ConnectWise is a major player in the managed service provider (MSP) space. They provide tools that MSPs use to manage IT for their clients. If those tools are compromised, it's not just ConnectWise's problem—it's a ripple effect that can hit thousands of businesses. ### What Exactly Happened? ConnectWise didn't give a ton of details, but here's what we know: they found out that some application identities were compromised. These identities are like digital keys that allow applications to access resources. In this case, the resources were Microsoft 365 tenants. So attackers got hold of these keys and used them to access M365 environments. In response, ConnectWise disabled seven application identities. One of them is ConnectWise Cloud Backup, with the ID 506e08f9-6e9a-4da4-942b-a099a03644ae. The others weren't listed, but you can bet they're being scrutinized. ### Why Should You Care? If you're an MSP or a business that relies on ConnectWise, this is a wake-up call. Application identities are often overlooked in security strategies. They're not like user accounts that have passwords and MFA. They're machine identities, and if they're not properly secured, they can be a backdoor into your systems. Think of it like this: you've locked all the doors and windows, but you left the garage key under the mat. Attackers will find it. ### What ConnectWise Is Doing ConnectWise is still investigating. They haven't said how the identities were compromised or who's behind it. But they're taking it seriously. Disabling the identities is a containment step. They're also likely working with affected customers to assess the damage. ### How to Protect Yourself If you're using ConnectWise or any other MSP tool, here are a few things to consider: - **Audit your application identities**: Regularly review which applications have access to your systems and what permissions they have. Remove any that aren't necessary. - **Implement least privilege**: Ensure that application identities only have the minimum permissions needed to function. - **Monitor for unusual activity**: Set up alerts for any suspicious behavior from application identities. - **Use conditional access**: If you're on Microsoft 365, use conditional access policies to restrict access based on conditions like location or device. ### The Bigger Picture This incident highlights a growing trend: attackers are targeting identity systems. It's not just about stealing passwords anymore. They're going after the keys that machines use to talk to each other. And often, those keys are less protected. For MSPs, this is a reminder that security doesn't stop at the user level. You've got to think about every entry point, including the ones that don't have a human attached. ConnectWise hasn't said when they'll restore the disabled identities or what the long-term fix will be. But for now, if you're affected, you should be in touch with their support and following their guidance. We'll keep you posted as more details emerge. In the meantime, take a hard look at your own application identities. You might be surprised by what you find.