Senior Software Engineer - C++, macOS

ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users. David Jones Mon, October 19, 2026 at 7:33 AM PDT ConnectWise said it suspended access to its Cloud Backup service after a suspected supply chain attack targeting Microsoft 365 users was uncovered in an attack that was first detected on Wednesday. ConnectWise said services for SaaS Security and Cloud Management were also suspended, as those services are connected to Cloud Backup, formerly known as SkyKick. There is no evidence that Cloud Backup partner backup data has been compromised, a ConnectWise spokesperson told Cybersecurity Dive. ConnectWise Cloud Backup is a backup and recovery service used across various managed service providers to manage their Microsoft 365 and Google Workspace data, according to Huntress. The service therefore has access to OneDrive, SharePoint, Teams and directory data. Microsoft Threat Intelligence on Saturday confirmed it was tracking an active supply-chain attack involving the compromise of a trusted OAuth App for ConnectWise Cloud Backup, according to a post on X. ConnectWise Cloud Backup is a multitenant vendor application, Microsoft said, noting that customers grant permission for the application to operate in their respective tenants. Microsoft researchers assess that the hacker "likely abused permissions previously granted by customers" to the application. Microsoft said it detected "broad successful principal authentication" on Thursday from an IP address 142.172.64[.]128. It also picked up Microsoft Graph API reconnaissance and attempts from the threat actor to add additional credentials in order to maintain access as a backdoor, according to the post. Huntress, a Maryland-based managed security platform, said a compromised user credential for ConnectWise Cloud Backup was used to gain unauthorized access to Microsoft 365 users, according to a blog post released Friday. Huntress said it confirmed unauthorized sign-ups in 162 customer tenants. "A Huntress partner tipped us off to suspicious activity from the ConnectWise application," Jon Semon, principal security operations analyst at Huntress, told Cybersecurity Dive. "We opened an investigation, and it turned into a rapid response involving multiple teams across Huntress." From a separate hosting address, the unidentified hackers attempted to sign into more than 1,000 Microsoft 365 customer accounts that were protected by Huntress, according to Semon. The hackers successfully gained access to more than 300 of them. Todyl, a cybersecurity platform for managed service providers, confirmed impacts from the same attack. The company said that an attacker used a valid credential to sign in to Microsoft 365 tenants, according to a blog post released Friday. ConnectWise provided recommendations for security teams to take: * Preserve available sign-in and audit records, while taking urgent action to contain. * Review application and user authentication, application credentials and federation trusts. * Check for unauthorized mailbox forwarding, inbox rules or delegated mailbox access. * Investigate any other identities changed or used during suspicious activity.

ConnectWise disables identities after Microsoft 365 breach. Attackers exploited ConnectWise application identities to compromise Microsoft 365 tenants. The company has suspended its cloud backup service and disabled several identities during the investigation. * ConnectWise disables seven application identities after a security breach. * Attackers gained unauthorized access to Microsoft 365 tenants through compromised identities. * Cloud backup services have been temporarily suspended. * Investigation is ongoing; customers are advised to monitor their environments. * Organizations using ConnectWise integrations should review permissions and activity logs. ConnectWise has taken emergency action to disable seven of its application identities following a security incident that led to unauthorized access to Microsoft 365 tenants. The breach, attributed to unknown threat actors, exploited these identities to gain entry into customer environments. In response, the company has paused its cloud backup offerings and initiated a full investigation. Customers are being urged to remain vigilant and assess their systems for unusual activity while remediation efforts continue. What happened. * Threat actors obtained unauthorized access to ConnectWise application identities. * These identities were used to infiltrate Microsoft 365 tenant environments. * Seven specific application identities have been disabled by ConnectWise. * One impacted service includes ConnectWise Cloud Backup. Impact and response. * Customers' Microsoft 365 data may have been exposed or manipulated. * ConnectWise has suspended its cloud backup functionality indefinitely. * An internal investigation is underway to determine the scope and cause. * Affected organizations should audit identity permissions and user activity logs. * No evidence yet suggests data was exfiltrated, but monitoring is recommended. Sources.

ConnectWise invalidated Cloud Backup credentials after Microsoft 365 attack. Its October 17 update said affected connection certificates and shared credentials were revoked; encrypted archives were preserved but unavailable for access or restoration. October 17, 2026 Key points * 01 ConnectWise said on October 17 that it revoked affected connection certificates and invalidated shared Cloud Backup credentials; its preserved archives were unavailable for access or restoration. * 02 Huntress reported unauthorized app sign-ins in 162 tenants in its telemetry by 19:00 UTC on October 16. * 03 Huntress described a separate ConnectWise Teams management app assigning itself Global Administrator and adding credentials to two other apps in one tenant. * 04 Todyl said it could not attribute some reads in monitored tenants with active backups because the same application identity served legitimate and suspicious activity, and per-request Graph logs were not collected. ConnectWise's October 17 update said it revoked Cloud Backup credentials, preserved encrypted archives and could not assess Microsoft 365 tenant activity. In its 1 p.m. EDT update on October 17, ConnectWise said it had revoked certificates used for affected application connections and invalidated shared credentials for ConnectWise Cloud Backup, formerly SkyKick. The company said its encrypted backup archives remained isolated and preserved, but access and restoration were unavailable. ConnectWise also said it had no evidence the archives had been accessed, while its investigation could not determine whether any individual customer's live Microsoft 365 tenant had unauthorized activity. ConnectWise's advisory ConnectWise reported that scheduled backup jobs were not running. New or changed data could therefore fall outside the recovery points already preserved. How the Microsoft 365 sign-ins worked. An app-only sign-in uses an application identity, called a service principal in Microsoft Entra ID, rather than a human user account. Huntress said the Cloud Backup app used a vendor-held API secret to obtain Microsoft Graph tokens. Because this was application authentication, employee MFA prompts did not apply. Huntress reported unauthorized sign-ins in 162 tenants in its telemetry by 19:00 UTC on October 16. Huntress's investigation Microsoft Threat Intelligence characterized the activity as an active supply-chain attack in its post. ConnectWise directed administrators to Microsoft Entra's Monitoring > Sign-in logs > Service principal sign-ins view and recommended filtering by the Cloud Backup app ID, 506e08f9-6e9a-4da4-942b-a099a03644ae. The standard User sign-ins view does not display this application authentication. Huntress reported a separate management-app finding. ConnectWise Cloud Management - MS Teams was a different application from Cloud Backup. Huntress reported that, in one tenant, the Teams management app assigned itself the Global Administrator role and added client secrets to two other applications, including a tenant-specific Huntress app. The sequence took about five minutes. Huntress also observed ConnectWise Cloud Management applications assigning directory roles in nearly 50 monitored tenants, mostly Exchange Administrator. The Teams app's ID is 24205314-2b89-4e07-a2a4-579e898a5640. Todyl found no directory changes by the Cloud Backup app in the tenants it examined. Its finding concerned that app; Huntress's role and credential changes involved the separate Teams management app. Todyl's investigation Why some data reads could not be attributed. In monitored tenants with active backup subscriptions, Todyl found read activity it could not attribute to legitimate backup operations or unauthorized use. Both used the same application identity, and the tenants were not collecting Microsoft Graph activity logs with per-request source IPs - information that could distinguish who made each request. For monitored tenants without an active subscription, Todyl reported no mailbox or file read records after token issuance and described that as no evidence of bulk copying. That observation sits alongside the access and logging findings, rather than determining what happened in every customer tenant. Other Languages Read this article in another available language.