ConnectWise Cloud Backup Breach: How Application Identities Were Exploited to Compromise Microsoft 365

On October 18, 2026, ConnectWise announced that unknown threat actors had obtained unauthorized access to seven application identities associated with its cloud backup service. These identities, which function as service accounts with elevated permissions in customer environments, were leveraged to compromise Microsoft 365 tenants belonging to ConnectWise users. The company immediately disabled the compromised identities and began investigating the scope of unauthorized access. The identities that were disabled included the ConnectWise Cloud Backup identity and six others, each identified by a unique application ID in Microsoft Entra (Azure AD).

The attackers did not breach ConnectWise's infrastructure through a zero-day vulnerability or a network intrusion in the traditional sense. Instead, they obtained credentials or tokens that allowed them to impersonate legitimate ConnectWise services within customer Microsoft 365 environments. This attack vector is known as application identity compromise, and it is particularly dangerous because these service identities often hold permissions that individual users do not have.

Application identities are service accounts that third-party software uses to interact with cloud services on behalf of the customer. ConnectWise Cloud Backup, for example, needs permission to read, back up and restore email, files and other data within a Microsoft 365 tenant. If an attacker compromises the identity that ConnectWise uses to access these resources, they inherit all of those permissions without needing the customer's actual password.

This is especially dangerous because application identities often bypass many security controls that protect individual user accounts. Multi-factor authentication does not apply to service identities. Conditional Access policies in Microsoft Entra may not catch suspicious behavior from a compromised application if it behaves normally (requests are made during business hours, from expected IP ranges, or follow historical patterns).

Threats actors target these identities because they are persistent, often have broad permissions and typically remain stable across environments. Once an attacker compromises an application identity, they can maintain access to customer data for an extended period without triggering alerts that would flag a human user account behaving abnormally.

While ConnectWise has not publicly disclosed the root cause, application identity compromise typically happens in one of these ways.

1. Credentials or OAuth tokens were stolen from ConnectWise systems or from its development, staging or production infrastructure
2. A vulnerability in ConnectWise software allowed an attacker to extract stored credentials or tokens
3. An insider threat or compromised employee account at ConnectWise leaked the credentials
4. The identities were obtained through a supply chain attack targeting a partner or dependency of ConnectWise

Regardless of the entry point, the attacker obtained the client ID and client secret (or an OAuth token) that ConnectWise had registered with Microsoft to grant the backup service access to customer tenants. With these credentials, the attacker could authenticate to Microsoft 365 as if they were ConnectWise performing legitimate backup operations.

If your organization uses ConnectWise Cloud Backup and stores sensitive data in Microsoft 365, this incident demonstrates several hard truths about cloud security. Your data is only as secure as the third-party integrations you grant access to it. Even reputable vendors can have their service accounts compromised. The permissions you grant to backup and management tools are often broad and difficult to audit in real time.

Attackers who gain access through a compromised application identity can read, modify or exfiltrate data at scale. They can also pivot to other connected systems, change settings and configuration, or create persistent backdoors. The compromise happened without any end-user password being cracked, without phishing attacks and without the victims being aware until the vendor detected it.

This is why organizations with strict data protection requirements (finance, healthcare, legal, government sectors) often implement zero-trust principles that assume third-party integrations are also potential attack surfaces.

If you use ConnectWise Cloud Backup, follow these actions to assess and contain the impact.

1. Review ConnectWise's official security advisory and breach notification on their support portal to confirm which identities were affected and get the latest timeline
2. Check your Microsoft 365 audit logs for unusual activity from the compromised application identities around the time the breach occurred
3. Export a list of all third-party application consents in your Microsoft Entra tenant and verify that only authorized applications have access to sensitive data
4. If you use Microsoft Defender for Cloud or Microsoft Defender for Identity, query recent authentication events from the ConnectWise identities
5. Temporarily disable or revoke the affected application identities in your Microsoft Entra App Registrations console to prevent further abuse
6. Contact ConnectWise support to confirm that your tenant was or was not among those that were compromised
7. Engage your incident response team if you find evidence of unauthorized access or data exfiltration in your logs

Look for these indicators in your Microsoft 365 and Azure logs that suggest the ConnectWise identities were misused against your tenant.

• Sign-in events from the compromised application IDs outside normal backup windows or from unusual IP addresses
• Bulk mailbox forwarding rules created or modified by the application service account
• Large data exports (e.g., mailbox export requests) initiated by the ConnectWise identity
• Changes to Azure AD roles or permissions assigned to the application identity
• Failed attempts to access restricted resources or sensitive email folders

Microsoft provides query templates in the Azure Portal under Microsoft Entra / Audit Logs to search for these patterns. If you have Advanced Audit enabled in your Microsoft 365 tenant, you can also see granular details about what the compromised application accessed.

This incident reinforces why vendor security reviews and ongoing monitoring of third-party access are not optional for organizations that handle sensitive data. Many companies grant application permissions and forget about them. They do not audit what data these applications actually access over time or what permissions they have been granted.

A mature approach to vendor risk includes the following practices.

• Request a SOC 2 Type II report from vendors before granting them broad permissions to your cloud environments
• Implement the principle of least privilege: grant only the minimum permissions the vendor needs to perform its function
• Use Microsoft Entra Privileged Identity Management (PIM) to time-limit administrative permissions for third-party applications
• Monitor application access through Cloud App Security or similar solutions that track and alert on unusual behavior from service accounts
• Maintain a current inventory of all application consents and their associated permissions
• Establish a renewal and re-audit schedule for third-party integrations at least annually

Was my data stolen in the ConnectWise breach?

ConnectWise has not disclosed whether all compromised identities were actually used to exfiltrate data or if some were discovered before abuse. You should review your own Microsoft 365 audit logs to determine whether your tenant was accessed by the compromised identities. ConnectWise customer support and your cloud security team can help you analyze the timeline.

Do I need to change all my Microsoft 365 passwords?

No. The compromise was of application identities, not user passwords. However, you should reset passwords for any administrative accounts that may have been affected if you find evidence of compromise in the logs. Ordinary user passwords do not need to be changed unless you have evidence that user accounts were compromised separately.

Can I trust ConnectWise to protect my data going forward?

Vendor trust is contextual. This breach does not mean ConnectWise is fundamentally untrustworthy, but it does mean you should apply enhanced monitoring, reduce permissions where possible and implement compensating controls on your side. Incident response and transparency matter; evaluate how ConnectWise communicates about the breach and what security improvements they announce.

Should I switch to a different backup provider?

Not necessarily immediately, but you should use this as a trigger to re-evaluate all third-party tools that have access to your Microsoft 365 data. Consider whether the backup provider's security maturity aligns with your risk tolerance. Switching vendors is often more disruptive than implementing stronger monitoring and access controls.

How do I verify that ConnectWise support communications are legitimate?

Visit the official ConnectWise website directly (not from a link in an email) and navigate to their security advisories section. Look for PGP signatures or official badges that verify the communication. Phishing attacks often follow major breaches, so verify out-of-band by calling ConnectWise support directly if you have questions about the legitimacy of a notification.

The real takeaway here is that third-party integrations are now a first-class attack surface that deserves the same attention as your perimeter security. This breach was not about a weak password or a user clicking a phishing link; it was about a service account being compromised and then used to silently access customer data at scale. You cannot prevent ConnectWise from being compromised, but you can dramatically reduce the impact by auditing what permissions you have granted to them, monitoring their activity and implementing detective controls that alert you if their identities behave abnormally. Start today by exporting your application consents from Microsoft Entra and documenting which vendors actually need what permissions. Then work backwards to revoke anything that is not strictly necessary.

Source: The Hacker News