ConnectWise: 1,000 Microsoft 365 Tenants Hit via Compromised Cloud Backup Credential

ConnectWise has shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers used a compromised application credential to break into Microsoft 365 tenants, an incident Microsoft Threat Intelligence characterized as "an active supply-chain attack," with the first unauthorized authentication attempts recorded on October 15, 2026, according to BleepingComputer. Huntress, a managed threat-detection platform, confirmed on October 16, 2026 that a Microsoft 365 API secret belonging to ConnectWise Cloud Backup had been compromised and used for unauthorized access to customer environments, and later reported sign-in activity from the attacker's IP address across almost 1,000 Entra tenants, with over 300 successful, per Huntress.

What was the specific vulnerability?

The specific vulnerability was a compromised application secret for the ConnectWise Cloud Backup (SkyKick) application, which the attacker used to authenticate directly to Microsoft 365 as the backup application and abuse permissions already granted in each tenant. According to Todyl researchers, whose analysis was reported by BleepingComputer, "Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats." Microsoft assessed that the attacker likely abused existing permissions including Directory.ReadWrite.All. In some tenants the intrusion went further: Huntress observed that on nearly 50 tenants, ConnectWise Cloud Management service principals covering Exchange Online, Microsoft Teams and Microsoft Graph assigned themselves directory roles, mostly Exchange Administrator. In one tenant, Huntress reported that "Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640) granted itself a Global Administrator role and added credentials to an MSP management tool and to Huntress's own application," a persistence operation that took about five minutes.

How was the incident detected?

The incident was detected when administrators flagged unauthorized access tied to a "SkyKick/CW breach" on Friday, October 17, 2026, with activity dating back to at least October 15. Huntress confirmed on October 16, 2026 that a ConnectWise Cloud Backup credential had been compromised and used against customer environments, initially identifying at least 162 compromised tenants in its own environment. Microsoft Threat Intelligence independently confirmed unauthorized authentication attempts from an IP address on October 15, and Todyl conducted a separate analysis of intrusions. All three firms tracked the activity to the same IP address, 144.172.64[.]128. Huntress also documented a second, targeted wave on October 15 that unsuccessfully targeted 16 Huntress-protected tenants in "the policy, national security, trade, and critical mineral sectors," most of which do not use ConnectWise products. Huntress recorded two sweeps in that wave: one from 09:25:04 to 12:35:50 UTC using Graph tokens via the SkyKick app, and a second from 13:54:39 to 14:20:24 UTC conducted manually, targeting Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and Office 365 Management APIs. Observed user agents included curl/7.88.1 and several python-requests and python-urllib versions.

What is the current impact?

The current impact is that roughly 1,000 Entra tenants showed sign-in activity from the attacker's IP address, over 300 of them successful, with data exposure in affected tenants limited to what the backup application's permissions allowed. In nine tenants Todyl analyzed, researchers saw only sign-in activity and no persistence, though Huntress documented role self-assignment and credential additions in others. ConnectWise disabled seven of its application identities as part of the investigation and shut down customer access to the Cloud Backup service, communicating that status as of October 17, 2026, 5:15 PM ET, per Huntress. The company stated there are "no indicators to date that Cloud Backup partner backup data has been compromised," meaning backup archives themselves are reported unimpacted. Huntress removed an unauthorized credential added to its own application on October 16; that credential had been used to sign in seven times in quick succession. The incident was also noted in The Hacker News weekly recap of October 19, 2026, per The Hacker News.

What are the next steps?

The next steps are for customers to keep the implicated applications disabled, audit all application credentials, and wait for ConnectWise to confirm that all credentials have been reset before re-enabling anything. Huntress advises disabling, not deleting, the implicated app IDs, including the Cloud Backup app ID 506e08f9-6e9a-4da4-942b-a099a03644ae, and warns that "Disabling M365 apps... will not remove credentials that were already added." Huntress recommends auditing activity in a window from approximately 01:00 UTC on October 15 to 02:00 UTC on October 16. Customers have been told not to re-enable the apps until ConnectWise confirms all credentials are reset. Organizations should also review directory role assignments made by the ConnectWise service principals and remove any credentials added to third-party applications during the window.

By the numbers

Source snapshot