When a supplier breach becomes your breach
A stolen credential at a cloud backup vendor gave attackers a path into thousands of companies that had done nothing wrong themselves. What happened, why it matters to every SME that runs on cloud software, and what you can actually control.
Most security advice assumes the attacker comes through your systems: an outdated plugin, a weak password, a missing header. This week showed a different path, and it is the one small businesses are most exposed to. Attackers did not break into their victims. They walked in through a door most victims did not know existed: an application permission granted to a software supplier.
What happened at ConnectWise
ConnectWise is a large IT management company. One of its products, Cloud Backup (formerly known as SkyKick), is used by IT service providers to back up the Microsoft 365 data of their customers: mailboxes, files, Teams and directory data. To do that job, the application holds very broad permissions in every organisation where it is installed.
A highly sensitive application credential fell into hostile hands. With it, attackers could authenticate as the application itself. No password, no multi-factor prompt, no phishing e-mail: a machine-to-machine sign-in that looked, to the platform, exactly like the legitimate backup service doing its job.
Microsoft attributes the campaign to Storm-0940, a China state-aligned threat actor. What happened next shows where attack tooling is heading: the group used an open-source agentic AI framework (ARTEX) to attempt sign-ins at more than 2,250 Microsoft 365 tenants, peaking at around 2,900 attempts per minute. In some cases, Microsoft reports, the attackers reached privileged cloud access less than three hours after first targeting a victim. Security firm Huntress confirmed unauthorised sign-ins in 173 tenants. ConnectWise took the backup service offline on 17 October and the investigation is still ongoing.
The scope of access is the part every business should sit with for a moment: the compromised application could read e-mail, files and directory data. In some tenants the attackers went further, changing application credentials and role assignments to leave a backdoor that can survive cleanup of the original incident.
Why one vendor key opens thousands of doors
Companies spend years hardening human logins: password managers, multi-factor authentication, conditional access. But third-party applications authenticate as applications. They hold permissions, not passwords, and they do not get MFA prompts. A consent that was granted once, perhaps years ago, keeps working until someone actively revokes it.
That is the structural lesson of this incident. Your security posture is not only the sum of your own controls. It includes every piece of software that has ever been granted access to your environment, and the security of the company behind each of them. None of the affected organisations chose to be attacked, and most could not have inspected the vendor's internal credential handling if they had wanted to.
The same pattern, in every industry
This is not an isolated story. Days after the ConnectWise disclosure, the Korean software company Duzon Bizon, whose accounting and tax products are used by around 110,000 small and midsize businesses, reported a breach of its own: attackers got in through a single employee's VPN account, and the data at risk includes payroll, sales and tax records of the small firms that depend on the software.
The common thread is concentration. Small businesses run on a handful of suppliers: accounting software, backups, hosting, an IT provider. Breach one supplier and you reach thousands of SMEs at once, each of them trusting software they cannot audit. For an attacker, that is leverage no individual small business could ever offer.
What you can actually control
You cannot patch your vendor's infrastructure. Four things are within your reach, and they map directly to what happened this week:
- Know which apps have access. Make an inventory of third-party applications connected to your Microsoft 365 or Google Workspace environment, including what permissions they hold. Remove what you no longer use: an integration you stopped using a year ago may still have full permissions today.
- Grant least privilege, and treat vendor integrations as privileged accounts. Minimum permissions, periodic access reviews, and a tested way to revoke access quickly. If a supplier needs to read your mailboxes, that connection deserves the same scrutiny as an admin account.
- Ask your critical suppliers hard questions before you need to. How do they protect the credentials that connect to your environment? Do they commit to notifying you after a breach, and how fast? What is their incident history? These questions are becoming normal in procurement, and NIS2 makes supply chain security an explicit part of the risk management duty for affected organisations.
- Watch your suppliers from the outside. You cannot see inside a vendor's cloud, but you can watch their public posture. An expired TLS certificate, a sudden DNS change or a blocklist listing at a critical supplier are early signs that something is wrong on their side, and they are exactly the signals an external monitor can pick up for you.
How Noroshi helps
Noroshi's supplier monitoring lets you register the domains of the suppliers your business depends on and checks each of them continuously: security headers, TLS certificate, DNS posture and abuse blocklists, with alerts when something changes. It is an early-warning picture of the companies behind your operations, and documented evidence for supply chain reviews, including the NIS2 angle.
To be clear about the limits: no external monitor would have prevented this specific credential theft, and we will not pretend otherwise. What supplier monitoring gives you is visibility of the risks you can see from the outside, and a maintained, evidence-ready picture of who your critical suppliers actually are. That inventory is the first question every auditor, insurer and incident responder will ask.
Set up supplier monitoring for your business →
Questions and answers
How do I know if my organisation is affected by the ConnectWise incident?
Only if your organisation uses ConnectWise Cloud Backup (formerly SkyKick), usually installed by your IT provider. Ask your MSP or check your Microsoft Entra admin centre for the affected enterprise applications. Microsoft advised affected organisations to keep those connections disabled until restoration guidance is issued, and to review sign-in activity from mid-October back to the start of the month where records allow.
Does multi-factor authentication protect against this kind of attack?
Not in this case. The attackers did not phish a password or defeat an MFA prompt: they signed in as the vendor application itself, using a stolen application credential. MFA protects human logins. Third-party app permissions are a separate surface that needs its own review.
How can I see which third-party apps can access our Microsoft 365 or Google Workspace?
In Microsoft 365, an administrator can list enterprise applications in the Entra admin centre, including the permissions each app holds. In Google Workspace, the admin console shows third-party app access under security settings. Both should be reviewed periodically: remove what you no longer use, and reduce broad permissions where possible.
Written by David Hildering, the engineer behind Noroshi. More about Noroshi.