ConnectWise Cloud Backup: attackers hijacked the service’s Microsoft 365 identities, MSPs must audit every customer tenant
High Microsoft 365 Supply chain Cloud

ConnectWise has confirmed unauthorised access to the application identities of its Cloud Backup service, formerly SkyKick, which connect to the Microsoft 365 tenants of managed service providers and their customers. The service is suspended, seven identities have been disabled, and partners are asked to review each tenant themselves.

What happened

On 16 October 2026, ConnectWise reported unauthorised access to application identities in the environment of Cloud Backup, its Microsoft 365 backup service for managed service providers (MSPs), formerly sold as SkyKick. These identities are the applications that partners authorise in Entra ID so the service can read mailboxes, Teams or SharePoint. ConnectWise suspended Cloud Backup on 17 October, then at 07:00 UTC the same day disabled seven application identities (Cloud Backup and six Cloud Management modules) and revoked their credentials. A third-party forensics firm has been engaged.

On 19 October, Cloud Backup, SaaS Security and Cloud Management were still suspended, with no restoration date: scheduled backups, archive access and restores are unavailable. The vendor says it has seen no successful malicious activity since its containment measures.

Who is affected

Every MSP using these tools, and every customer tenant connected to them, including dormant connections. According to The Hacker News, citing researchers, the compromised credential was used to sign in to 173 Microsoft 365 tenants. ConnectWise says the backup archives remain encrypted and isolated, but admits it cannot tell on its own whether a given tenant suffered unauthorised activity: that check falls to each administrator.

What to do now

  1. Export logs today: Entra ID keeps sign-in and audit logs for only 7 days on the free tier and 30 days on P1/P2. Download them as JSON, along with the Purview audit.
  2. Disable the applications locally: in Entra ID, Enterprise applications, look up each Application ID listed by ConnectWise (for example 506e08f9-6e9a-4da4-942b-a099a03644ae for Cloud Backup), set sign-in to No, but do not delete anything yet.
  3. Search the sign-ins from 13 October (ideally from 1 October) for the addresses 144.172.64.128, 144.172.64.99 and 144.172.64.60, and for the service principals concerned.
  4. Review the audit log: secrets or certificates added to applications, new applications, consents, role assignments, Conditional Access changes, mailbox forwarding and inbox rules.
  5. Plan a backup alternative for as long as the service is down.

Our take

A backup tool holds broad, permanent rights over every tenant it protects: when its identity is compromised, all its customers are exposed at once. Keep an inventory of third-party applications with access to your Microsoft 365, limit their permissions, and keep logs longer than the platform does by default.

Sources

How we choose, verify and write our analyses →

The way in was a third party. Check what your suppliers expose publicly — no intrusion, public information only:

Check a supplier Check a server

Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.

Talk to an expert Our managed server services →
Back to all news