ConnectWise disables seven application identities after Microsoft 365 compromise

ConnectWise said it disabled seven application identities on October 17 at 07:00 UTC after attackers obtained unauthorized access and compromised Microsoft 365 tenants. The action extends across Cloud Backup and Cloud Management connections, including Teams, Exchange Online and SharePoint Online. The company also revoked certificates for affected Cloud Backup connections across all users. Scheduled backups have stopped, and affected archives and restoration capabilities remain unavailable. ConnectWise says existing archives remain encrypted, isolated and preserved, with no evidence attackers accessed them. Disabling connections prevents new authentication but does not undo tenant changes. Previously issued tokens may remain usable, and credentials attackers planted in separate identities require additional remediation.