ConnectWise suspended access to its Cloud Backup service after malicious activity involving trusted application identities was linked to unauthorised access in Microsoft 365 customer environments.
The incident is a strong example of why supply-chain security is not limited to software updates. Cloud integrations can hold broad permissions by design, and when those identities are compromised an attacker may inherit access that customers intentionally granted to a trusted provider.
Organisations often watch privileged user accounts closely while paying less attention to non-human identities such as service principals, application registrations and integration accounts. Those identities can be just as powerful, and sometimes more persistent.
The response therefore has to happen on both sides of the supplier relationship. Providers need to revoke compromised access quickly, while customers need enough visibility to review sign-in activity, permissions and changes inside their own tenants.
The wider lesson is that trusted software can become trusted access for an attacker. Third-party applications should be inventoried, permissions should be kept as narrow as possible and organisations should know how to disable an integration safely if confidence in it is lost.