ConnectWise disabled seven application identities after attackers compromised Microsoft 365 tenants. Here's what happened and what MSPs should do next.
If you're an IT pro relying on ConnectWise for cloud backup, you'll want to sit down for this one. On Saturday, the company announced it had disabled seven application identities after unknown attackers managed to get unauthorized access and compromise Microsoft 365 tenants. Yeah, that's as bad as it sounds.
### What Exactly Happened?
ConnectWise is still digging into the details, but here's what we know so far: the threat actors somehow obtained access to these application identities, which are essentially the keys to the kingdom for integrated services. Once inside, they were able to compromise Microsoft 365 tenants. The company has since disabled seven identities, including the one tied to ConnectWise Cloud Backup.
For those who aren't deep in the weeds of identity management, application identities are like service accounts that allow different apps to talk to each other. If someone gets hold of them, they can move laterally and cause all sorts of trouble. In this case, the trouble involved Microsoft 365 tenants—meaning email, files, and whatever else lives in those environments could be at risk.
### The Ripple Effect on MSPs and Their Clients
Managed service providers (MSPs) are the ones feeling this the most. Many of them use ConnectWise to manage backups for their clients. With Cloud Backup suspended, there's a gap in protection. If you're an MSP, you're probably already fielding calls from worried clients. And honestly, who can blame them?
> "When a tool you trust gets compromised, it's not just about the data—it's about trust. MSPs are now in the hot seat, explaining to clients why their backup solution is offline."
This incident also highlights a broader issue: the supply chain in cybersecurity. Attackers are increasingly targeting the tools that MSPs use, because breaching one MSP can give them access to dozens or hundreds of downstream clients. It's a classic pivot attack, and it's becoming more common.
### What Should You Do Right Now?
If you're affected, here are a few steps to consider:
- **Check your logs** for any unusual activity related to the compromised application identities. Look for unexpected sign-ins or data access patterns.
- **Rotate credentials** for any connected apps or services, especially if they share identity infrastructure with ConnectWise.
- **Communicate with clients** transparently. Let them know what happened, what you're doing about it, and what they can do to stay safe.
- **Review your backup strategy**—do you have a secondary solution in place? If not, now's the time to think about redundancy.
### The Bigger Picture
This isn't the first time a major vendor has had its identity infrastructure compromised, and it won't be the last. The lesson here is that identity is the new perimeter. Attackers don't need to break down the front door if they can find a spare key lying around. And application identities? They're often the spare key that nobody remembers to lock up.
For now, ConnectWise says it's continuing its investigation. We'll update this story as more details emerge. In the meantime, stay vigilant, keep an eye on your tenants, and maybe double-check those app permissions. It's a jungle out there.
