> ## Content Index
> Fetch the complete content index at: https://thecoverwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# ConnectWise shuts Cloud Backup after attack hits 162 Microsoft 365 tenants
- URL: https://thecoverwire.com/connectwise-cloud-backup-supply-chain-attack-m365/
- Published: 2026-10-17T07:30:00.000Z
- Updated: 2026-11-02T11:34:54.000Z
- Description: Attackers signed in using the backup app's credential, in what Microsoft called an active supply-chain attack.
- Author: CoverWire
- Tags: Cyber, #desk-risk

ConnectWise has shut its Cloud Backup service after attackers used the service's application credential to enter Microsoft 365 tenants, showing how one vendor identity can create exposure across many customers.

Security firm Huntress had confirmed unauthorised sign-ins in 162 tenants by 19:00 UTC on 16 October. Microsoft Threat Intelligence described the incident as an active supply-chain attack, according to BleepingComputer.

ConnectWise Cloud Backup, formerly SkyKick Cloud Backup, provides backup and recovery for managed service providers and IT teams using Microsoft 365 and Google Workspace.

Backup services need broad access to read and restore mail, files and Teams data. The attacker authenticated as the backup application itself, inheriting the permissions customers had already granted it, Huntress said.

These were app-only sign-ins, so there was no user and no multifactor authentication prompt. Security firm Todyl said the application's existing permissions gave the attacker the technical ability to read and write mail, attachments, OneDrive and SharePoint files, and Teams chats, according to BleepingComputer.

Huntress said that in about 50 tenants it monitors, ConnectWise management apps assigned themselves directory roles, mostly Exchange Administrator. In one tenant, an app granted itself Global Administrator and planted new credentials on two other applications, including Huntress's own.

In a 17 October update, Huntress said it had found almost 1,000 Entra tenants with sign-in activity from the attacker's IP address. More than 300 sign-ins succeeded.

ConnectWise announced the interruption at 05:01 UTC on 17 October. An update at 01:00 UTC on 18 October said the service was still unavailable and scheduled backups were not running. The company had disabled seven application identities.

"The affected shared Cloud Backup credentials are no longer valid. Previously issued access tokens may remain usable until they expire or are otherwise invalidated," ConnectWise said. It said it had no indication that stored backup data was compromised.

Huntress warned that disabling the applications would not remove credentials already planted in customer tenants. Previously issued tokens could also remain valid until they expired or were invalidated.

In the two tenants it reviewed most closely, Huntress found no evidence of mailbox or file manipulation, or changes to users or policies. It said directory reads through Microsoft Graph leave no audit record.

Huntress said the credential worked against every tenant that had consented to the application, although it had not seen attackers use an MSP tenant to reach its clients in this incident.

ConnectWise said it had no indication that stored backup data was compromised. How the attacker obtained the credential, and whether any customer data was taken, was not known.

Related coverage: [Brit adds cyber to Acturis Package for brokers at commercial renewal](https://thecoverwire.com/brit-cyber-launches-on-acturis-package/) and [Old Mutual says provider error may have exposed customer phone numbers](https://thecoverwire.com/old-mutual-provider-configuration-error-customer-data/).

## Sources

- [BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/?ref=thecoverwire.com)
- [Huntress: ConnectWise (SkyKick) vendor credentials abused in M365 attacks](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access?ref=thecoverwire.com)
- [The Hacker News: ConnectWise suspends Cloud Backup](https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html?ref=thecoverwire.com)