INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ConnectWise suspends Cloud Backup service after supply chain attack

| 2026-10-26 12:20 CRITICAL MEDIUM RANSOMWARE & EXTORTION SUPPLY CHAIN
JSON
Executive Summary
AI-generated
On October 26, 2026, Safe Data Storage Ltd, a UK-based SME IT services company founded in 2004, was targeted by an attack that compromised its cloud backup system. The attackers exploited stolen credentials to gain access to Microsoft 365 environments of customers using the affected service, which is designed to protect data in Microsoft 365 and Google Workspace. It appears that the attackers used these compromised credentials to access mailboxes, OneDrive, SharePoint, Teams, and other data without leaving a trail of evidence. The current status indicates that Safe Data Storage Ltd has suspended its cloud backup services due to the attack, which also impacted several of ConnectWise's services, including Cloud Backup, SaaS Security, and Cloud Management platforms.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CleaverCleaver
Target & Sectors
FIVE_EYES FIVE_EYES technologytechnology
Incident Timeline
‎2025/10/19
ConnectWise has dealt with multiple security incidents in the past, including a nation-state attack on its remote management and monitoring software that impacted some of its customers.
‎October 13
Threat actors used password spray attacks against four law firms on October 13.
‎October 15
Threat actors began using ConnectWise's Cloud Management apps to assign themselves directory or administrative roles on systems monitored by Huntress starting October 15.
general_metric 50 systems
By October 15, about 50 systems monitored by Huntress saw attackers use ConnectWise's Cloud Management apps to assign themselves directory or administrative roles.
‎2026/10/26
Threat actors exploited vulnerabilities in ConnectWise Cloud Backup to gain unauthorized access to Microsoft 365 environments, compromising credentials and allowing them to add permissions.
organisation Microsoft 365
Description: Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR,…
Incident responders at cybersecurity firm Huntress said a credential belonging to ConnectWise Cloud Backup was compromised and used to gain access to the customers’ Microsoft 365 environment.
All.”  ConnectWise Cloud Backup is a cloud-based backup and recovery service designed to help protect data in Microsoft 365 and Google Workspace.
The company said they do not have visibility into partner and customer environments, so they cannot determine whether a particular customer’s Microsoft 365 environment was breached.
organisation Safe Data Storage Ltd
Description: Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR,…
organisation SME
Description: Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR,…
threat_actor Cleaver
Description: Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR,…
organisation ISO
Description: Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR,…
organisation SAFE Backup/Backup Plus
Description: Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR,…
organisation Arcserve
Description: Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR,…
organisation Huntress
Incident responders at cybersecurity firm Huntress said a credential belonging to ConnectWise Cloud Backup was compromised and used to gain access to the customers’ Microsoft 365 environment.
organisation Google Workspace
All.”  ConnectWise Cloud Backup is a cloud-based backup and recovery service designed to help protect data in Microsoft 365 and Google Workspace.
organisation Safe Data Storage
🏴‍☠️ Auditteam has just published a new victim : Safe Data Storage.
organisation ConnectWise
ConnectWise suspends Cloud Backup service after supply chain attack.
organisation Microsoft
IT management software company ConnectWise shut down several of its services this weekend after Microsoft and other cybersecurity companies warned of a supply chain attack impacting its cloud backup system.
organisation Directory
Microsoft confirmed in its own statement that threat actors “likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.
organisation ReadWrite
ReadWrite.
organisation OneDrive
The tool needs broad access to mailboxes, OneDrive, SharePoint, Teams and other data, according to Huntress.
organisation SharePoint
The tool needs broad access to mailboxes, OneDrive, SharePoint, Teams and other data, according to Huntress.
organisation Teams
The tool needs broad access to mailboxes, OneDrive, SharePoint, Teams and other data, according to Huntress.
organisation Recorded Future News
A spokesperson told Recorded Future News that there is “no indication" that backup data was compromised.
organisation Cloud Management
The current service interruptions apply to the cloud backup system as well as the SaaS Security and Cloud Management platforms.
organisation ConnectWise Cloud Backup
Huntress warned that backup services like ConnectWise Cloud Backup normally hold read access to mail, files, Teams, and directory data so it can copy them and restore them.
organisation Conditional Access
If an application can assign directory roles, as we saw in one tenant, it can make itself a Global Administrator, and an administrator can add credentials to other applications, create new applications and grant them permissions, reset passwords and authentication methods for users, and change Conditional Access policies,” Huntress added.
infrastructure Windows
Ransomware and internal threats are becoming increasingly sophisticated; recovery windows are shrinking and regulatory pressures continue to increase.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
Description: Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR,…
Incident responders at cybersecurity firm Huntress said a credential belonging to ConnectWise Cloud Backup was compromised and used to gain access to the customers’ Microsoft 365 environment.
All.”  ConnectWise Cloud Backup is a cloud-based backup and recovery service designed to help protect data in Microsoft 365 and Google Workspace.
The company said they do not have visibility into partner and customer environments, so they cannot determine whether a particular customer’s Microsoft 365 environment was breached.
Metrics
infrastructure
​Windows
Affected Product
Ransomware and internal threats are becoming increasingly sophisticated; recovery windows are shrinking and regulatory pressures continue to increase.
Intelligence Sources
Tecnonews N/A
Ransomware Live 2026-10-26
TheRecord 2026-10-19