A backup service was switched off after its own key was used to read customers' email

ConnectWise turned off its own Cloud Backup service at 7am UTC on Saturday, and it is still off. The reason: somebody had taken the credentials that service uses to sign into customers' Microsoft 365 accounts, and had been quietly using them since Tuesday.

The sequence, as ConnectWise and the security firm Huntress tell it, is short. Scripted sign-in attempts on 13 and 14 October. Genuine malicious activity on the 15th, all from one address, 144.172.64.128. Close to a thousand Microsoft 365 tenants saw attempts, around 300 sign-ins succeeded, and Huntress has confirmed unauthorised access inside 173 of them. On Saturday ConnectWise disabled seven of its application identities at once, covering Cloud Backup, Cloud Management and its connections into Teams, Exchange Online, SharePoint and Microsoft Graph.

Here is the part worth understanding even if you have never heard of ConnectWise. Multi-factor authentication did nothing, because nobody logged in as a person. Backup software holds its own key to your mailbox, and whoever holds that key simply is the backup software as far as Microsoft is concerned. Mail, OneDrive files, SharePoint documents, Teams chats: all readable. ConnectWise says the backup archives themselves remain encrypted and it has seen no sign they were touched, and it has not said when the service returns.

If an outside IT company manages your work PC, this is their weekend rather than yours. The lesson for home is simpler: a backup that exists only inside someone else's account is one compromised account away from being nobody's backup. Tendvane's one-click backup copies Documents, Pictures and Desktop to a drive you physically own, which is the copy that survives another company's bad Tuesday.