ConnectWise backup credentials exposed multiple Microsoft 365 tenants

ConnectWise has disabled key cloud services and is investigating unauthorized access to customers’ Microsoft 365 environments after a credential tied to its Cloud Backup platform was compromised and used to authenticate into customer tenants, prompting Huntress to identify suspicious sign-ins across 162 organizations. The activity involved the Cloud Backup application obtaining Microsoft Graph access tokens using a credential associated with ConnectWise’s own tenant.