The ConnectWise Cloud Backup breach is a reminder that your Microsoft 365 tenant is only as safe as the vendors you have let into it. On 15 October 2026, an unknown attacker used a credential belonging to a backup app to sign in to customer Microsoft 365 tenants, one after another. Nobody had to phish a single user.
Table of Contents
What happened
The app is ConnectWise Cloud Backup, formerly SkyKick. Managed service providers (MSPs) install it so they can back up their clients’ mailboxes, OneDrive, SharePoint and Teams. To do that job it holds wide permissions in every tenant where it is installed.
According to Huntress, the attacker held a credential for that app. Huntress describes it as one that lives in the vendor’s own tenant, so customers could not see it, rotate it or restrict it. The attacker used it to ask Microsoft Graph for access tokens, one tenant at a time.
On 15 October, between 06:13 and 08:34 UTC, the app authenticated from a single hosting-provider IP address. Huntress saw the sign-ins land in sorted tenant-ID order, a few seconds apart. That pattern points to a script working through a target list. Todyl saw the same thing in its own customers’ tenants, with one token per tenant and no follow-up.
How big is the ConnectWise Cloud Backup breach?
The numbers in the ConnectWise Cloud Backup breach are still moving. The Hacker News reported that Huntress had confirmed unauthorised sign-ins in 173 partner and customer tenants. Huntress’s own post put the count at 162 as of 19:00 UTC on 16 October, and said almost 1,000 tenants showed sign-in activity from the attacker’s IP, with more than 300 succeeding. The figure depends on when you ask and whose logs you read.
Huntress also reported a separate, hands-on thread. In one partner tenant, a ConnectWise Cloud Management app gave itself the Global Administrator role. A Python script then added new client secrets to two other apps, including an MSP management app and a Huntress application. The whole sequence took about five minutes. Huntress has not tied that activity to the same operator as the sweep.
Was data stolen in the breach?
Nobody can say yet. Todyl found no new accounts, role changes or persistence in the tenants it watched. Huntress found no mail or file access in the one audit log it examined in detail.
That is weaker comfort than it sounds. Huntress notes that directory reads through Graph leave no audit trail. Todyl adds that per-request IP data lives in Graph activity logs, which were not being collected in the tenants it reviewed. Its advice is to treat data in any affected tenant as exposed until proven otherwise.
What to do about the ConnectWise Cloud Backup breach
Both firms give the same core advice. Do it in this order:
- Disable the ConnectWise Cloud Backup app in Entra (Enterprise applications, app ID 506e08f9-6e9a-4da4-942b-a099a03644ae). Disable it, do not delete it, so you can re-enable it without fresh consent. Backups pause while it is off.
- Revoking user sessions will not help, because the attacker is not a user. Todyl notes that tokens already issued can stay valid for up to 90 minutes after you disable the app.
- Check service principal sign-ins for that app from 13 October onwards. Look for IP addresses outside Microsoft and Azure ranges. A clean result does not prove you were untouched.
- Look in the audit log for any ConnectWise or SkyKick app adding itself to a directory role, and for client secrets you did not create on your other apps.
- Turn on Microsoft Graph activity logs now. They are not retroactive.
- Keep the apps off until ConnectWise confirms every credential has been reset.
ConnectWise has shut off application access for the backup product and says it has found no evidence that partner backup data was compromised. Todyl reports that the vendor’s 16 October advisory said containment measures were in place but did not confirm a credential rotation.
The wider lesson
Look at what the attacker skipped in this ConnectWise Cloud Backup breach. There was no malware, no stolen password and no multi-factor prompt to defeat. The app signed in as itself, and Microsoft treated it as the trusted tool it was meant to be. Huntress also reported a password spray against four law firm tenants on 13 and 14 October from the same IP, with no successful user sign-ins seen. The app route did not need that.
Most firms keep a list of suppliers but not a list of the cloud apps those suppliers have installed in their tenant. Conditional Access cannot be applied to many third-party multi-tenant apps, so least-privilege consent and removing unused apps are the main controls. Ask your MSP which apps they have consented to, what each can read, and who holds the credential.
This is the same trust problem we covered in our software supply chain defence checklist, only with a SaaS app in place of a software update. A cloud penetration test of your Azure and Entra setup will show which of your app registrations could do this kind of damage.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
