The company stresses that the suspension does not mean customer environments were compromised, only that it is not confident it can operate the services safely. It says existing archives remain encrypted, isolated and preserved, with no evidence of unauthorised access to them. It has published indicators of compromise, disabled integrations between Cloud Backup and Exchange, Teams and SharePoint Online, and asked partners to check the Microsoft 365 environments they manage for signs of compromise.

Security firm Huntress has offered a more pointed account. It says a compromised Cloud Backup credential, a client assertion that lives in ConnectWise's own tenant, was used to sign in to 162 Microsoft 365 tenants between October 15 and 16, and that by October 17 it had seen sign-in activity from the attacker's IP address in nearly 1,000 Entra tenants, with over 300 successful sign-ins. In one tenant, Huntress observed the ConnectWise Cloud Management app for Teams granting itself Global Administrator rights and then adding new credentials to two other applications. ConnectWise says it cannot discuss threat actor attribution while the investigation continues.

The incident leaves end-user organisations in an awkward spot. Many rely on managed service providers precisely so they never have to learn the underlying platforms, and MSPs are under no obligation to disclose which tools they use. Huntress warns that disabling the abused ConnectWise apps will not remove credentials attackers may already have added, so businesses must review the credentials on all of their Microsoft 365 applications. Platform providers serving MSPs are a frequent target for exactly this reason: the 2021 Kaseya attack showed how one compromise can cascade through many downstream customers.