What happened in the ConnectWise Cloud Backup breach
The ConnectWise Cloud Backup breach has kept the service offline since October 17, 2026, after attackers used a stolen Microsoft 365 credential to break into customer tenants. The service was formerly known as SkyKick, a company ConnectWise bought in September 2024 along with the business continuity provider Axcient. Restoration is in progress, and the company has not said when it will finish.
In an October 20 update, ConnectWise said it had “completed an account and credential reset in the affected Cloud Backup environment and are preparing for phased service restoration.” That sentence describes preparation, not a return to service. Customers who depend on the product are still waiting for a date.
The attack matters because of who sits in the middle. Managed service providers use Cloud Backup to protect their clients’ Microsoft 365 data, so one compromised vendor credential reached businesses through their IT providers. Huntress said its own customers are mostly small and mid-sized businesses, which means the exposure reaches deep into the smaller end of the market.
How the Cloud Backup shutdown unfolded
The timeline is short, but several dates matter for cleanup work:
- October 15, 2026: Huntress observed the Cloud Backup application authenticating to customer Microsoft environments between 06:13 and 08:34 UTC.
- October 15: Huntress said the last malicious sign-ins from the original address came at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC.
- October 16: ConnectWise first disclosed the incident.
- October 17: ConnectWise disabled seven application identities, and the shutdown took effect at 07:00 UTC.
- October 20: ConnectWise said it had reset accounts and credentials and was preparing phased restoration.
- October 22: Microsoft attributed the activity to Storm-0940, a China-linked group.
The tenant count moved quickly that week. Channel Dive reported that Huntress confirmed unauthorized access in 162 customer tenants by October 16. Tech-Insider later reported 173 Microsoft 365 partner and customer tenants with confirmed unauthorized sign-ins as of October 17.
How attackers got into Microsoft 365 tenants
This attack ran on trust rather than passwords. A Microsoft 365 credential, an API secret tied to the Cloud Backup application, was compromised, and Huntress confirmed attackers used it to reach customer environments. Because customers had already granted the application broad permissions, attackers did not need to steal each customer’s password one by one.
Microsoft’s assessment points to the same mechanism. Threat actors “likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.” That wording means the damage flowed through access customers had already approved, not through weak passwords alone.
The scale is harder to pin down. Help Net Security reported that Huntress found nearly 1,000 Microsoft 365 accounts with sign-in attempts from the attackers’ address, and more than 300 of them succeeded. Huntress has not confirmed that the same operator was behind every attempt. Microsoft tied the activity to Storm-0940 and reported more than 2,250 Microsoft 365 tenants, at times reaching about 2,900 attempts a minute. TechCrunch put the rate at almost 3,000 attempted sign-ins per minute.
USA 24 has already reported on the Storm-0940 campaign and its 2,250-tenant figure. This story focuses on what the attackers did after they got in, and on what the cleanup looks like. Token abuse is not new, either. USA 24 recently covered how stolen Microsoft 365 tokens breached 79 organizations without passwords.
Global admin rights and the backdoors left behind
This is the part administrators should worry about most. Attackers did not stop at the backup app. Huntress reported evidence that they gave themselves “global administrator” rights, the highest level of access possible in Microsoft Entra ID, for a ConnectWise app named Cloud Management - MS Teams.
From there, they added credentials to other trusted apps, including an MSP management app and Huntress’s own security app. The Record reported that Microsoft also described Microsoft Graph API reconnaissance and attempts to add credentials that would maintain access as a backdoor. Credentials attached to existing applications can outlive the original compromise, which is why shutting down the vendor’s service does not close the exposure.
Cybernews reports that attackers created credentials valid until 2028, which could keep access open after ConnectWise disabled the apps. That claim has not been confirmed elsewhere in the reporting reviewed for this story, so treat it as unverified until Microsoft or ConnectWise addresses it directly. If it holds, a disabled app is not the end of the exposure, and every credential the attackers added must be found and removed. Previously issued tokens may also stay valid until they expire, according to The Hacker News.
Restoration status and the open questions
Backup access is down. Scheduled backups are not running, archives are inaccessible, and restores are impossible, according to Techzine. ConnectWise said it found no indication that stored backup archives had been compromised, but it also noted that this does not establish whether customers’ live Microsoft 365 environments were affected. A spokesperson told The Record there is no timeline for restoration.
For customers, that combination is the hard part. Intact archives do not help if they cannot be reached, and ConnectWise has not yet established whether live tenants were affected.
The root cause is still open. ConnectWise has said that “whether a product vulnerability contributed has not been established, and the original credential-exposure mechanism remains under investigation.” CyberScoop reports the company declined to explain how the credential was obtained.
This is not ConnectWise’s first serious incident. In 2025, the company disclosed a breach involving a “sophisticated nation state actor” that affected a very small number of ScreenConnect customers, according to Dark Reading. That earlier event was separate and should not be merged with the Cloud Backup attack. Buyers weighing vendors that hold broad access into customer tenants may want to ask how those vendors protect their own credentials.
Which customers are affected
The exposure runs through managed service providers, so the affected group is not limited to ConnectWise’s direct customers. Confirmed tenant counts rose from 162 to 173 in about a day. One MSP can manage dozens of tenants, and some of the confirmed tenants may belong to organizations that stopped using Cloud Backup long ago but never revoked its access. That makes the count a snapshot rather than a complete list.
Cybernews reports that hackers have compromised more than 300 organizations and are now targeting national security and critical infrastructure sectors. That is a single-source claim, so attribute it carefully. The figure also differs in kind from Huntress’s count. Huntress describes accounts, while Cybernews describes organizations, and the reporting does not settle whether 300-plus successful sign-ins equal 300-plus compromised companies.
What admins should do this week
If you manage Microsoft 365 for clients, or you are a client who relies on an MSP, these steps come first:
- Disable the ConnectWise app IDs, but do not delete them. Keeping them intact preserves the records investigators will need.
- Review every application in Microsoft Entra ID for credentials added since October 13, a step recommended in security reporting from BleepingComputer and Cybersecurity Dive.
- Check mailbox forwarding rules, inbox rules and delegated access for changes nobody made.
- Look for unexpected high-privilege grants, including Directory.ReadWrite.All, on any application in the tenant.
- Limit who holds Application Administrator roles, and restrict how client secrets are created.
Disabling an app does not reverse changes already made in a tenant, so each change has to be reviewed and reversed on its own. If your provider used Cloud Backup, ask it directly which tenants were connected and whether any of your applications were touched. Get the answer in writing.
What to watch next
Three things will decide how serious this becomes. The first is a dated restoration plan, which ConnectWise has prepared but not announced. The second is a root-cause explanation for the stolen API secret, which the company has not provided. The third is whether the 2028 credential claim holds up, since only one outlet has reported it. No U.S. government advisory had surfaced in the reporting reviewed for this story, so Microsoft’s Storm-0940 attribution remains the main official account.
The longer question is structural. MSPs and software vendors hold broad permissions across customer tenants because that is how these tools work, and this incident shows how much damage a single compromised app can carry. Expect more buyers to ask vendors how they store secrets, how often they rotate them and how quickly they can revoke them. Clients of MSPs will feel the cost first, and the next few weeks will show whether the service returns on a schedule anyone can plan around.
