A compromised ConnectWise application credential was used to sign in to hundreds of Microsoft 365 tenants, leading the vendor to suspend Cloud Backup. The incident shows why consented app permissions deserve as much scrutiny as user passwords.
ConnectWise, a widely used vendor of cloud backup and remote management software, suspended its Cloud Backup, SaaS Security and Cloud Management services after detecting a security incident on 14 October 2026. At the centre of the incident is not a software vulnerability but a stolen application credential — the identity ConnectWise uses to connect to its customers' Microsoft 365 environments.
What happened
According to The Hacker News, the attackers used the stolen credential to mint Microsoft Graph access tokens and sign in to customer tenants. Security firm Huntress reported sign-in activity from the malicious IP address across roughly 1,000 Entra tenants, 300 of which succeeded. Field Effect reported unauthorised sign-ins confirmed in more than 160 tenants. By 07:00 UTC on 17 October, ConnectWise had disabled seven application identities: one Cloud Backup app and six Cloud Management apps covering Teams, Exchange Online, Graph, Partner Center and SharePoint Online.
Field Effect also reported that in at least one tenant, one of the applications assigned itself the Global Administrator role and added fresh credentials to other trusted applications — meaning access could survive the revocation of the original credential. ConnectWise says it has found no evidence that backup archives were accessed, and that the archives remain encrypted and isolated. The investigation is ongoing.
Why it matters
Most organisations think about Microsoft 365 security in terms of user passwords and multi-factor authentication. This access came through neither. It came through an application identity — a service principal that someone in the tenant consented to once, possibly years ago. These identities do not prompt for MFA, do not care about business hours, and are rarely reviewed again after the day they are installed. Field Effect notes the application held high-privilege permissions such as Directory.ReadWrite.All.
In other words, a company can have a flawless password policy and still leave a door open through a vendor app it approved and forgot.
What this means for smaller companies
Most SMEs running Microsoft 365 have third-party applications connected for backup, email signatures, CRM integration, reporting or security scanning. Each one can reach mailboxes, SharePoint content and directory data with the permissions granted at install time.
There is a compliance angle too. Under Turkey's Personal Data Protection Law No. 6698, a data controller that delegates part of its processing to a supplier remains responsible for the technical and administrative measures protecting that data. A supplier-side compromise does not remove the breach notification obligation.
What Kamer Bilişim recommends
- Build an application inventory. Open the "Enterprise applications" list in your Microsoft 365 admin centre and record who consented to each app, when, and with which permissions. Revoke consent for anything unrecognised or no longer in use.
- Turn off user consent and extend Conditional Access to workload identities. Stop end users from approving applications on their own and move to an admin consent workflow; then apply location- and risk-based Conditional Access policies to service principals as well as to people.
- Keep one backup copy independent of the vendor. At least one copy of your Microsoft 365 data should sit outside your cloud backup provider's identity infrastructure, in immutable storage. Test a real restore at least once a quarter.
If you would like your Microsoft 365 application permissions reviewed, a privilege inventory prepared, or your backup architecture made less dependent on a single supplier, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: The Hacker News, Field Effect
Source: The Hacker News