ConnectWise suspends cloud services after credential breach

ConnectWise discovered that attackers had gained unauthorized access to seven of its application identities on October 14, according to internal monitoring. The company disabled the compromised identities on October 17 and, as a precaution, revoked the certificates that supported its Cloud Backup, SaaS Security and Cloud Management services, taking those services offline for all users.

How attackers used credentials

The attackers did not need to steal individual customer passwords. By using the stolen ConnectWise application credentials they could obtain tokens from Microsoft Entra ID and act as ConnectWise’s own applications, giving them access to mailboxes, SharePoint files, Teams messages and directory data. The compromised credentials also allowed the attackers to add their own client secret to another trusted application in a tenant or create a new application, creating a second key that could persist even after the original credential was revoked.

Because Cloud Backup was suspended, scheduled backups no longer run and customers cannot restore data from the service. ConnectWise says the existing backup archives remain encrypted, isolated and preserved, but they are not currently accessible. This creates an operational risk for organizations that rely on the service to recover their systems and information.

ConnectWise has advised customers to verify the status of all application connections, preserve sign‑in and audit logs, and review application credentials, federation trusts, directory roles, consent grants, policy changes, mailbox forwarding rules and delegated mailbox access. Huntress and other analysts recommend that partners check for sign‑in activity from the IP 144.172.64.128 beginning on October 13 and to take containment steps that do not erase evidence. The company has not identified any specific threat actor and has no confirmation that partner backup data was compromised.