The ConnectWise Cloud Backup breach reached at least 173 Microsoft 365 partner and customer tenants through one compromised vendor credential. The attackers did not need a user password or a multifactor authentication prompt. The credential belonged to ConnectWise Cloud Backup, the product formerly known as SkyKick Backup, which protects Microsoft 365 and Google Workspace data for managed service providers.
Huntress, which first reported the campaign, confirmed unauthorized sign-ins as of October 15. Because the abused secret sits with a vendor that MSPs rely on, any US firm that consented the app could be exposed. ConnectWise has shut off the application while it investigates, and it said its investigation found no evidence that partner backup data itself was compromised.
What happened in the ConnectWise Cloud Backup breach
Reporting started October 16 and went wide on October 17. Huntress said the confirmed count rose from 162 tenants to 173, according to SparTech Software. The timeline below combines the dates reported across the sources.
| When (2026) | What the sources report |
|---|---|
| Oct. 13 and 14 | One IP address password-sprayed four law-firm tenants. No successful user sign-ins were linked to that activity. |
| Oct. 15, 06:13 to 08:34 UTC | Attackers requested Microsoft Graph tokens from IP 144.172.64.128. |
| Oct. 16, 19:00 UTC | Huntress had confirmed 162 affected tenants. |
| Oct. 17 | The count reached 173 and coverage spread widely. |
| No date given | ConnectWise suspended Cloud Backup application access until further notice. |
The token requests came from a hosting-provider address. A researcher quoted by The Hacker News put the problem plainly: "The app's credential is in hostile hands," said security researcher Jonathan Semon. Tenants were hit in sorted GUID order, seconds apart, which suggests automated scripting against a target list, according to Rod Trent's security check-in.
Why one vendor credential reached so many Microsoft 365 tenants
The abused secret was a vendor-side client assertion credential, not a password that individual customers held. That detail explains the reach. The ConnectWise application already had consent in each customer tenant, so the stolen access worked anywhere the app held permissions.
Those pre-consented permissions gave read and write access to mailboxes through Exchange Web Services. They also reached OneDrive and SharePoint files, Teams chats and directory data, and none of it triggered an MFA challenge, according to The Hacker News and Rod Trent's check-in.
The escalation went further in at least one tenant. A related ConnectWise application granted itself Global Administrator and added new client secrets to an MSP management app and a Huntress application, according to daily.dev. Attacker-added secrets were reported valid into 2028, so resetting the first credential would not finish the job on its own.
Coverage repeatedly describes the underlying problem as structural. A single trusted multitenant app with broad permissions can reach every tenant that consented to it. The MSP model multiplies that exposure, because one vendor sits between many firms and their Microsoft 365 data.
Which Microsoft 365 tenants face the most risk
US managed service providers and the Microsoft 365 customers they support are the most exposed group. The app is consented into customer tenants, and MSP management apps may be affected too. An MSP compromise can therefore become a customer compromise in a single step.
Individual consumers are not directly affected unless their business uses this MSP or backup stack. A company that outsources IT should ask its provider whether it uses ConnectWise Cloud Backup and whether the app is consented in its tenant.
Law firms have a specific reason to pay attention. Huntress reported that a single IP address password-sprayed four law-firm tenants on October 13 and 14, according to Memesita. No successful user sign-ins were linked to that spraying, and the sources reviewed do not tie it to the token activity.
How to check whether your Microsoft 365 tenant was hit
The most useful checks look at the app identity itself, not only at people. Standard user sign-in reviews can miss this activity.
- Review Microsoft Entra service principal sign-in logs, not only user sign-ins, for activity from 144.172.64.128.
- Audit credentials and role assignments added since October 13, 2026. Huntress and Todyl both recommend that starting window.
- Look for ConnectWise or SkyKick apps that have granted themselves directory roles, and check MSP management apps for new client secrets.
- Enable Microsoft Graph activity logs so token use is recorded. Huntress cautioned that the lack of visible mail activity may complicate detection.
Record every finding before you change anything. An intact audit trail will help you confirm the scope later.
Disabling the ConnectWise Cloud Backup app without leaving a gap
The guidance from researchers and vendors is consistent. Disable the ConnectWise Cloud Backup application in your tenant rather than deleting it. Do not re-enable it until ConnectWise confirms credential resets. The sources reviewed do not say when ConnectWise will restore the service or confirm those resets.
Disabling the app is only part of the response. Organizations that revoke user sessions alone do not end this access, according to Todyl. Nicholas Koken of Todyl said tokens already issued can stay valid for up to 90 minutes after an app is disabled in a tenant, per Memesita. Plan for that window, and pair the disable step with the credential and role audit described above.
What the reports still do not know
Several basic questions remain open. Huntress has not attributed the campaign to a named actor. Reports describe access and token use, but they do not confirm that mail or files were stolen. Huntress cautioned that the missing mail activity may slow detection, which makes the data question harder to answer quickly.
How the credential leaked is also unresolved. Cybersecurity News suggests poor access management or phishing, but it found no evidence that ConnectWise itself was breached. Treat that as an inference, not a confirmed finding.
The Hacker News also tied a separate software supply-chain compromise, which ran from April to July 2026, to a previously undocumented cluster called UNC7017. The article did not say whether UNC7017 is connected to this campaign.
What to watch next
Three developments will shape the story in the coming weeks. The first is whether ConnectWise publishes a restoration date and confirms credential resets, because that decides when MSPs can safely re-enable the application. The second is whether Microsoft Threat Intelligence, which says it is tracking an active supply-chain attack involving the trusted OAuth app, publishes indicators beyond a single IP address. The third is whether the tenant count moves again, since it already climbed from 162 to 173 in a day.
The pattern also looks familiar. Trusted software that reaches many systems through one weak point is the shape of the AOMEI Backupper backdoor that hit Windows users through tampered updates. Vendor-held remote access raises similar stakes, as the BeyondTrust zero-day advisory shows with its patch-now, then-rebuild guidance.
For MSPs, the test this week is straightforward. List every consented app that can reach customer mail and files, and confirm who would be notified if one of them changed.
