One Stolen Login Just Unlocked 173 Microsoft 365 Accounts
Robert Moore ·
Listen to this article~3 min
A single compromised ConnectWise credential let attackers sign into 173 Microsoft 365 tenants. Here's what that means for MSPs and their clients—and how to protect yourself.
You know that feeling when you leave your front door unlocked by accident? Now imagine that door opens into 173 different houses. That's basically what happened with a compromised ConnectWise Cloud Backup credential.
Security researchers are raising alarms about an active campaign where unknown attackers used a single stolen Microsoft 365 (M365) login to break into customers' M365 environments. ConnectWise Cloud Backup, formerly SkyKick, is a cloud backup and recovery service built for managed service providers (MSPs).
### The Domino Effect of One Compromised Credential
Here's the thing: MSPs are like the landlords of the IT world. They manage M365 tenants for dozens or even hundreds of small businesses. So when one credential gets compromised, it's not just one company at risk—it's every client that MSP touches.
The attackers didn't need to be geniuses. They just needed one weak spot. And once they were in, they could potentially access emails, files, and sensitive data across all those tenants.
> "A single compromised credential shouldn't be a master key to hundreds of businesses. But in the MSP world, it often is."
That's the scary reality. And it's not just about this one incident—it's a pattern we keep seeing.
### What This Means for Your Business
If you're an MSP or you work with one, this should make you pause. Here's what you need to think about:
- **Credential hygiene**: Are you using strong, unique passwords? Multi-factor authentication (MFA) is non-negotiable.
- **Least privilege**: Does that backup service really need access to everything? Probably not.
- **Monitoring**: Would you even know if someone logged in from a weird location at 3 AM?
- **Third-party risk**: Your security is only as strong as your weakest vendor.
### The Bigger Picture
This isn't the first time a third-party service has been the weak link. Remember the SolarWinds hack? Or the constant stream of supply chain attacks? The lesson is clear: attackers go after the path of least resistance.
And MSPs? They're a juicy target because they hold keys to so many kingdoms.
So what do you do? Start by asking hard questions. Talk to your MSP about their security practices. Make sure they're not cutting corners. And if you're an MSP yourself, audit your access controls today—not tomorrow.
Because the next stolen credential could be yours.
