What to look out for today
ConnectWise has suspended parts of its cloud backup service while investigating an incident where attackers accessed ConnectWise application identities and compromised Microsoft 365 tenants. If your IT support provider uses ConnectWise, or you use ConnectWise services directly, treat this as a potential supplier risk and be alert for knock-on disruption and phishing.
Why this matters to smaller businesses
- Microsoft 365 is core business infrastructure for many SMEs (email, SharePoint/OneDrive, Teams). If tenant access is affected, it can quickly become a business-stopper.
- Supplier incidents often trigger impersonation scams (fake “security update” emails, fake invoices, urgent password reset requests) aimed at finance and admins.
- Backup and recovery plans may be impacted if cloud backup services are paused or altered during investigation/containment.
Warning signs
- Unexpected Microsoft 365 sign-in prompts, password reset emails, or MFA notifications you didn’t initiate.
- New or unfamiliar “apps” requesting access to your Microsoft 365 data, or consent prompts appearing unexpectedly.
- Unplanned changes to backup jobs/status, missed backups, or “service suspended/disabled” messages from your IT provider.
- Emails or calls claiming to be from your IT provider or ConnectWise asking you to “re-authenticate”, “approve access”, or “download a tool”.
- Sudden mailbox rules, forwarding set up, or unusual activity around invoices and payment instructions.
How attackers may exploit the situation
- Follow-on phishing: criminals may use news of the incident to pressure staff into clicking links or approving access (“urgent tenant remediation”).
- Abuse of trusted connections: where suppliers have integrations into customer Microsoft 365 tenants, attackers may attempt to pivot via those connections.
- Business email compromise (BEC): access to mailboxes can be used to intercept invoices, change bank details, or request urgent transfers.
- Disruption: attackers and/or containment actions can interrupt backup and restore capability at the worst time.
What to do today
- Confirm with your IT provider whether you are affected (directly or indirectly) and what immediate safeguards are in place.
- Remind staff (especially finance/admin) to treat “IT security urgent” messages with caution and verify via a known phone number.
- Review Microsoft 365 access quickly: look for unexpected sign-ins, suspicious prompts, and any unusual changes to email forwarding or mailbox rules.
- Check backups: confirm you have a recent recoverable backup and understand any temporary limitations while services are suspended.
- Harden payment processes today: enforce call-backs for any bank detail changes and high-value transfers.
Ask your IT provider
- Do we use ConnectWise (including Cloud Backup) anywhere in our environment, directly or via a subcontractor/MSP toolchain?
- Have you checked our Microsoft 365 tenant for unusual app consents, new identities, or suspicious sign-in activity?
- What is our current backup status, and do we have an alternative restore path if cloud backup is disrupted?
- What additional monitoring is in place this week for mailbox forwarding rules, abnormal logins, and payment-change email patterns?
- What should staff do if they receive a “re-authenticate/approve access” request linked to this incident?
Patch watch - only one short paragraph, and only if relevant
No specific patch action is the priority for most SMEs today. This is primarily a supplier/integration risk: focus on verifying your exposure through your IT provider, monitoring Microsoft 365 access, and tightening approval processes around payments and account changes.
One action today
Send a short internal note today: “Do not approve unexpected Microsoft 365 access prompts or ‘re-authenticate’ requests; verify any IT/security request by phoning our known IT contact.”
Related Actions On Cyber resource
Actions On Cyber: Supplier Incident & Third‑Party Access Checklist (what to ask your MSP and what to verify in Microsoft 365)
Sources
- ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.