Our takeConnectWise used a single credential for its Cloud Backup app identities in customer M365 tenants; attackers abused it and the company has now suspended the service. Rotate any app credentials you share with vendors.Security Resilience desk
What this means for you — Security leader:Review all M365 service principals and application consents tied to third-party backup tools; revoke the ConnectWise Cloud Backup identity immediately and monitor for anomalous access.
What this means for you — Lean IT orgs:If you use ConnectWise Cloud Backup, your M365 data may be at risk; contact your provider for status and consider alternative backup arrangements until the service resumes.
What this means for you — MSP:Audit every client tenant for the ConnectWise Cloud Backup app registration; revoke consents and rotate credentials where present, then validate backup coverage from unaffected providers.
What this means for you — Researcher:ConnectWise Cloud Backup (ex-SkyKick) application identities were abused via a compromised credential; the service has been suspended while the incident is contained.