11/03/2026
When the backup vendor is the breach.
A stolen ConnectWise Cloud Backup credential let attackers into customer Microsoft 365 environments without user interaction. Huntress confirmed unauthorized sign-ins in 162 tenants by Oct. 16, with broader activity detected across nearly 1,000. Some of the apps escalated their own permissions to Global Admin and added credentials for persistence. ConnectWise disabled the affected app identities on Oct. 17 and reset the credential on Oct. 19.
A backup platform is privileged access, not just software. Audit enterprise apps for credentials added since Oct. 13; disable affected apps rather than deleting them. Verify backups with a restore test: a green status email isn't proof.
Has your backup vendor ever needed admin-level access?
Sources: Huntress (Oct. 16), BleepingComputer (Oct. 17), CSO Online (Oct. 19)