A cloud backup service used by many IT providers was broken into this past week. The attackers then used it to get into Microsoft 365 accounts that belonged to other people.<\/p>\n\n\n\n
If your office uses Microsoft 365 for email and files, this is worth five minutes of your Monday. You don’t need to panic. You do need to know what to ask.<\/p>\n\n\n\n
Here is what we know so far, in plain words. We’re relying on BleepingComputer’s report<\/a>, and details may change as the investigation continues.<\/p>\n\n\n\n According to that report, the company behind a cloud backup service (formerly sold under another name) said it found unauthorized access to “application identities” in its backup environment. It shut down access to the service for its partners and users.<\/p>\n\n\n\n Reports started showing up on Friday. IT administrators noticed strange access to client data in their Microsoft 365 setups. Later that day, Huntress, the managed security company we’re an authorized partner of, said it had identified at least 162 compromised tenants in its own environment.<\/p>\n\n\n\n A “tenant” is just your company’s Microsoft 365 space. Your email, files and user accounts all live there.<\/p>\n\n\n\n Microsoft also confirmed it saw unauthorized sign-in attempts tied to this service from a single IP address on October 15. The vendor said it has no signs so far that the backup data itself was compromised. It is still investigating.<\/p>\n\n\n\n Think of a backup program as a house guest you gave a key to. You let it in so it could copy your mail and files every night.<\/p>\n\n\n\n In Microsoft 365, that kind of program gets its own identity, called a service principal<\/strong>. That’s a fancy name for “a login for software instead of a person.” You grant it permissions once, and it keeps them.<\/p>\n\n\n\n Per the report, the attackers signed in as the backup program itself, using its secret. That secret works like a password for software. Once in, they had the same permissions your office had already handed over.<\/p>\n\n\n\n One administrator reported an alert that an old backup app had given itself the Exchange Administrator role. Exchange is the part of Microsoft 365 that runs email. That admin said they hadn’t used the app in years.<\/p>\n\n\n\n Most of us have heard “turn on MFA.” That’s the text-message or app prompt that asks “is this really you?” It’s still good advice, and we’ll keep giving it.<\/p>\n\n\n\n But in this case, researchers said the sign-ins came from an automated script. No person logged in. Since there was no user login, protections like MFA were ineffective.<\/p>\n\n\n\n The lesson isn’t “MFA is useless.” It’s that MFA protects people, and these attackers walked in as software<\/strong>. Both doors need watching.<\/p>\n\n\n\n Small offices often have old apps connected to Microsoft 365. A backup tool from three years ago. A mailing app someone tried once. A scheduling add-on.<\/p>\n\n\n\n Each one may still hold permission to read mail or files, even if nobody has opened it in years. That’s the “house guest who still has a key” problem.<\/p>\n\n\n\n You also may not know which backup service your IT provider uses. That’s a fair thing to ask. Whoever looks after your computers should be able to tell you in one email.<\/p>\n\n\n\n If your backups run through a service like this, the question isn’t “are we doomed?” It’s “do we know what’s connected, and do we have another copy somewhere?” A backup that lives in only one place is a single point of failure. Our backup and disaster recovery<\/a> service uses off-site copies that get tested, because a backup you’ve never tried to restore is just a hope.<\/p>\n\n\n\n News like this can feel scary. Most small offices will not be directly affected. Still, a few quiet checks now are cheaper than a surprise later.<\/p>\n\n\n\n If you’d like a second pair of eyes, we offer a free 30-minute assessment<\/a>. We’ll look at your computers, email and backups and tell you what to fix first. No cost, no contract, remote or on-site. You can also read about how we help watch for threats on our security page<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" A cloud backup service was used to break into Microsoft 365 accounts. Here is what happened and a short checklist for small offices.<\/p>\n","protected":false},"author":2,"featured_media":607,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,5],"tags":[32,35,39,41],"series":[],"class_list":["post-407","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-cloud-infrastructure","tag-backups","tag-cybersecurity","tag-microsoft-365","tag-small-business"],"_links":{"self":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/comments?post=407"}],"version-history":[{"count":2,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/407\/revisions"}],"predecessor-version":[{"id":409,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/407\/revisions\/409"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/media\/607"}],"wp:attachment":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/media?parent=407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/categories?post=407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/tags?post=407"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/series?post=407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What happened<\/h2>\n\n\n\n
How the attackers got in<\/h2>\n\n\n\n
Why multi-factor sign-in didn’t stop it<\/h2>\n\n\n\n
Why this matters for a small office<\/h2>\n\n\n\n
What to do this week<\/h2>\n\n\n\n
\n
A note on staying calm<\/h2>\n\n\n\n