ConnectWise has shut down its Cloud Backup service after attackers accessed application identities within the platform and used them to compromise customer Microsoft 365 tenants. This is a supply-chain attack in the clearest sense: the victim organisations did not need to be targeted directly. Their exposure came through a trusted third-party service they had already granted access to their environment.
The mechanism matters here. Modern SaaS ecosystems run on OAuth permissions and delegated application access. When a supplier is compromised at the application identity level, every tenant that trusted that application becomes a potential target. The attacker inherits whatever permissions the integration was granted, often with no authentication challenge and no immediate indication that anything is wrong.
If your organisation uses or has used ConnectWise Cloud Backup, the immediate steps are clear: review what permissions that application held in your Microsoft 365 tenant, check your unified audit logs for anomalous activity, and revoke access if you cannot confirm the integration is clean. More broadly, this is a timely prompt to audit all third-party application access across your M365 environment. Most organisations have granted permissions to services they no longer actively use, and those dormant grants represent real exposure.