The service disruption extends beyond backups. With Cloud Backup suspended, scheduled backups, access to affected archives, and restoration capabilities remain unavailable. SaaS Security monitoring and alerting, as well as Cloud Management’s user and license management functions, have also been taken offline while remediation continues.
Huntress said its investigation had not confirmed data theft. In the one tenant whose audit logs it examined in detail, the firm found no recorded mail or file access, but warned that this did not prove that no data had been taken. Some Microsoft Graph directory reads do not leave an audit trail, limiting what investigators can establish from available records, it noted.
Both companies have urged partners and customer administrators to review their Microsoft 365 environments. ConnectWise’s guidance calls for checks of application sign-ins, credentials, directory roles, consent grants, policy changes, and possible mailbox forwarding or other persistence mechanisms.