Microsoft 365 Breach: The Supply-Chain Attack That Could Hit Your Business

Michael Miller · 2026-10-17

Imagine waking up to find that hackers have quietly slipped into your Microsoft 365 environment—not by guessing your password, but by exploiting a trusted supplier. That's exactly what happened when ConnectWise, a major IT management software provider, became the latest victim of a supply-chain attack. The company has now shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after attackers accessed application identities and compromised Microsoft 365 tenants. If you're an IT professional or business owner, this should make you sit up and take notice. Supply-chain attacks are on the rise, and they're becoming more sophisticated. Let's break down what happened, why it matters, and what you can do to protect your organization. ### What Went Down at ConnectWise? ConnectWise is a well-known name in the managed service provider (MSP) space. Its Cloud Backup service is used by countless businesses to protect their Microsoft 365 data—emails, files, and more. But recently, hackers managed to access application identities within ConnectWise's system. These identities are like digital keys that allow applications to interact with Microsoft 365. Once compromised, they can be used to infiltrate customer tenants. In response, ConnectWise has temporarily disabled access to the Cloud Backup service. That means customers can't back up or restore data right now. It's a serious disruption, but it's also a necessary step to contain the breach. ### Why This Attack Matters Supply-chain attacks are particularly dangerous because they target the trust we place in third-party vendors. You might have strong security measures in place, but if a supplier is compromised, your data can be at risk. This incident highlights a few critical points: - **Third-party risk is real:** Even if your own house is in order, your vendors might not be. Always assess the security posture of your partners. - **Application identities are a weak spot:** These identities often have broad permissions and are rarely monitored. Attackers love them because they can move laterally without detection. - **Backup services are prime targets:** If hackers can access your backups, they can hold your data hostage or delete it entirely. That's why backup services need extra protection. ### How to Protect Your Microsoft 365 Environment So, what can you do to avoid becoming the next headline? Here are some practical steps: - **Audit third-party app access:** Regularly review which applications have access to your Microsoft 365 tenant. Remove any that aren't essential. - **Implement least privilege:** Ensure that application identities have only the permissions they need—nothing more. - **Monitor for unusual activity:** Set up alerts for suspicious behavior, like unexpected data downloads or configuration changes. - **Use multi-factor authentication (MFA):** Enforce MFA for all users, especially administrators. - **Have a backup plan:** Don't rely solely on one backup service. Consider a diversified approach, and test your restore process regularly. ### The Bigger Picture This isn't the first supply-chain attack, and it won't be the last. As businesses increasingly rely on interconnected services, the attack surface grows. The ConnectWise incident is a wake-up call: we need to think beyond our own walls and consider the security of our entire ecosystem. For now, ConnectWise is working to remediate the issue. If you're a customer, keep an eye on their updates and follow their guidance. And if you're not a customer, use this as a reminder to review your own vendor relationships. Stay safe out there.