ConnectWise shuts down backup and management services after security breach

[Warden]

The ConnectWise security incident we discussed last week has grown. The Register's Simon Sharwood reports that the company has suspended its Cloud Backup, SaaS Security and Cloud Management services after finding unauthorised access on 15 October

As of Sunday afternoon, customers still could not back up, open archives or restore data. Security vice president Jason Ferguson said existing archives remain encrypted and show no sign of being accessed. That is reassuring, but losing backup access for days is a serious problem for any business

Security firm Huntress reported that a Microsoft 365 API secret belonging to Cloud Backup was stolen and used to get into customer tenants. In one tenant, a ConnectWise Teams app gave itself Global Administrator rights and added credentials to two other apps, which shows how far the attackers could reach

ConnectWise has published indicators of compromise, disabled its integrations with Exchange, Teams and SharePoint, and declined to name the attacker. The Register compares the incident with the 2021 Kaseya attack, another case where a tool used by managed service providers became a route into many customers at once

Supply chain attacks on managed service tools are especially dangerous because one breach can affect hundreds of organisations. Customers should check for the published indicators, review app permissions and rotate any credentials linked to ConnectWise services

Should managed service tools be held to higher security standards? And how would your business cope without backups for a week?

ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFUwww.theregister.com