ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU

ConnectWise, a SaaS-for-managed services provider, has suspended its Cloud Backup, SaaS Security, and Cloud Management services after discovering unauthorized access within its Cloud Backup environment. The incident occurred on October 15, and customers using these services have been unable to back up data, access archives, or restore data as of October 18.

According to ConnectWise, existing archives remain encrypted, isolated, and unaltered, with no evidence of unauthorized access. However, Huntress, a security firm, claims that a Microsoft 365 credential belonging to ConnectWise Cloud Backup has been compromised and is being used to gain unauthorized access to customers' Microsoft 365 environments.

ConnectWise has disabled certain integrations between Cloud Backup and external applications, but it cannot discuss threat actor attribution. The company urges customers to investigate their M365 environments for signs of compromise, as MSPs managing end-user relationships may not disclose their platforms. MSPs are not obligated to disclose the platforms they use, making it challenging for end-users to determine if their services are compromised.