ConnectWise suspends Cloud Backup after application identity compromise

ConnectWise found unauthorized access to seven application identities tied to Cloud Backup on October 14 and suspended the service by revoking connection certificates. Microsoft attributed the activity to Storm-0940; sign-in attempts hit over 2,250 tenants, with 162 confirmed by Huntress.

• Seven application identities disabled October 17; service halted via certificate revocation
• Microsoft reports sign-in attempts at 2,250+ tenants; Huntress confirms 162
• ConnectWise has not published Cloud Backup permissions or the exposure cause
• Microsoft attributes the activity to Storm-0940