# ConnectWise Cloud Backup Breach Gave Attackers Global Admin Rights

- URL: https://usa-24.com/connectwise-cloud-backup-breach-4/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-25T05:38:37.829Z
- Updated: 2026-10-25T05:38:37.842Z
- Topics: ConnectWise, Microsoft 365, Supply Chain Attack, Managed Service Providers, Storm-0940

> Cloud Backup has been offline since October 17 after attackers abused a stolen Microsoft 365 API secret. ConnectWise is resetting credentials, but it has not set a restoration date.

## Key takeaways

- ConnectWise Cloud Backup has been offline since October 17, 2026, when the company disabled seven application identities and cut access to the service.
- Attackers used a compromised Microsoft 365 API secret and gave themselves global administrator rights in Microsoft Entra ID for the ConnectWise app Cloud Management - MS Teams.
- Huntress reported nearly 1,000 Microsoft 365 accounts with sign-in attempts from one address, and more than 300 of those attempts succeeded.
- Microsoft tied the activity to Storm-0940 and reported more than 2,250 Microsoft 365 tenants targeted, at times reaching about 2,900 attempts per minute.
- ConnectWise has not set a restoration timeline, so admins should disable rather than delete the ConnectWise app IDs and audit every credential added since October 13.

## What happened in the ConnectWise Cloud Backup breach

The ConnectWise Cloud Backup breach has kept the service offline since October 17, 2026, after attackers used a stolen Microsoft 365 credential to break into customer tenants. The service was formerly known as SkyKick, a company ConnectWise bought in September 2024 along with the business continuity provider Axcient. Restoration is in progress, and the company has not said when it will finish.

In an [October 20 update](https://thehackernews.com/2026/10/connectwise-resets-credentials-as-cloud.html), ConnectWise said it had “completed an account and credential reset in the affected Cloud Backup environment and are preparing for phased service restoration.” That sentence describes preparation, not a return to service. Customers who depend on the product are still waiting for a date.

The attack matters because of who sits in the middle. Managed service providers use Cloud Backup to protect their clients’ Microsoft 365 data, so one compromised vendor credential reached businesses through their IT providers. Huntress said its own customers are mostly small and mid-sized businesses, which means the exposure reaches deep into the smaller end of the market.

## How the Cloud Backup shutdown unfolded

The timeline is short, but several dates matter for cleanup work:

- October 15, 2026: Huntress observed the Cloud Backup application authenticating to customer Microsoft environments between 06:13 and 08:34 UTC.
- October 15: Huntress said the last malicious sign-ins from the original address came at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC.
- October 16: ConnectWise first disclosed the incident.
- October 17: ConnectWise disabled seven application identities, and the shutdown took effect at 07:00 UTC.
- October 20: ConnectWise said it had reset accounts and credentials and was preparing phased restoration.
- October 22: Microsoft attributed the activity to Storm-0940, a China-linked group.

The tenant count moved quickly that week. [Channel Dive](https://www.channeldive.com/news/connecwise-suspends-cloud-backup-hacker-microsoft-365/833370/) reported that Huntress confirmed unauthorized access in 162 customer tenants by October 16. [Tech-Insider](https://tech-insider.org/connectwise-cloud-backup-breach-173-tenants-2026/) later reported 173 Microsoft 365 partner and customer tenants with confirmed unauthorized sign-ins as of October 17.

## How attackers got into Microsoft 365 tenants

This attack ran on trust rather than passwords. A Microsoft 365 credential, an API secret tied to the Cloud Backup application, was compromised, and [Huntress confirmed](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) attackers used it to reach customer environments. Because customers had already granted the application broad permissions, attackers did not need to steal each customer’s password one by one.

Microsoft’s assessment points to the same mechanism. Threat actors “likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.” That wording means the damage flowed through access customers had already approved, not through weak passwords alone.

The scale is harder to pin down. [Help Net Security](https://www.helpnetsecurity.com/2026/10/19/connectwise-cloud-backup-suspended-security-incident/) reported that Huntress found nearly 1,000 Microsoft 365 accounts with sign-in attempts from the attackers’ address, and more than 300 of them succeeded. Huntress has not confirmed that the same operator was behind every attempt. [Microsoft tied the activity to Storm-0940](https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687) and reported more than 2,250 Microsoft 365 tenants, at times reaching about 2,900 attempts a minute. [TechCrunch](https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/) put the rate at almost 3,000 attempted sign-ins per minute.

USA 24 has already reported on the [Storm-0940 campaign and its 2,250-tenant figure](https://usa-24.com/connectwise-cloud-backup-breach-3/). This story focuses on what the attackers did after they got in, and on what the cleanup looks like. Token abuse is not new, either. USA 24 recently covered how [stolen Microsoft 365 tokens breached 79 organizations without passwords](https://usa-24.com/microsoft-365-token-replay-attack/).

## Global admin rights and the backdoors left behind

This is the part administrators should worry about most. Attackers did not stop at the backup app. Huntress reported evidence that they gave themselves “global administrator” rights, the highest level of access possible in Microsoft Entra ID, for a ConnectWise app named Cloud Management - MS Teams.

From there, they added credentials to other trusted apps, including an MSP management app and Huntress’s own security app. [The Record](https://therecord.media/connectwise-suspends-cloud-backup-service-supply-chain-attack) reported that Microsoft also described Microsoft Graph API reconnaissance and attempts to add credentials that would maintain access as a backdoor. Credentials attached to existing applications can outlive the original compromise, which is why shutting down the vendor’s service does not close the exposure.

[Cybernews](https://cybernews.com/security/connectwise-cloud-backup-breach-microsoft-365/) reports that attackers created credentials valid until 2028, which could keep access open after ConnectWise disabled the apps. That claim has not been confirmed elsewhere in the reporting reviewed for this story, so treat it as unverified until Microsoft or ConnectWise addresses it directly. If it holds, a disabled app is not the end of the exposure, and every credential the attackers added must be found and removed. Previously issued tokens may also stay valid until they expire, according to [The Hacker News](https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html).

## Restoration status and the open questions

Backup access is down. Scheduled backups are not running, archives are inaccessible, and restores are impossible, according to [Techzine](https://www.techzine.eu/news/security/145071/connectwise-shuts-down-cloud-backup-after-hack-on-microsoft-365-tenants/). ConnectWise said it found no indication that stored backup archives had been compromised, but it also noted that this does not establish whether customers’ live Microsoft 365 environments were affected. A spokesperson told [The Record](https://therecord.media/connectwise-suspends-cloud-backup-service-supply-chain-attack) there is no timeline for restoration.

For customers, that combination is the hard part. Intact archives do not help if they cannot be reached, and ConnectWise has not yet established whether live tenants were affected.

The root cause is still open. ConnectWise has said that “whether a product vulnerability contributed has not been established, and the original credential-exposure mechanism remains under investigation.” [CyberScoop](https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/) reports the company declined to explain how the credential was obtained.

This is not ConnectWise’s first serious incident. In 2025, the company disclosed a breach involving a “sophisticated nation state actor” that affected a very small number of ScreenConnect customers, according to [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/connectwise-breached-screenconnect-customers-targeted). That earlier event was separate and should not be merged with the Cloud Backup attack. Buyers weighing vendors that hold broad access into customer tenants may want to ask how those vendors protect their own credentials.

## Which customers are affected

The exposure runs through managed service providers, so the affected group is not limited to ConnectWise’s direct customers. Confirmed tenant counts rose from 162 to 173 in about a day. One MSP can manage dozens of tenants, and some of the confirmed tenants may belong to organizations that stopped using Cloud Backup long ago but never revoked its access. That makes the count a snapshot rather than a complete list.

Cybernews reports that hackers have compromised more than 300 organizations and are now targeting national security and critical infrastructure sectors. That is a single-source claim, so attribute it carefully. The figure also differs in kind from Huntress’s count. Huntress describes accounts, while Cybernews describes organizations, and the reporting does not settle whether 300-plus successful sign-ins equal 300-plus compromised companies.

## What admins should do this week

If you manage Microsoft 365 for clients, or you are a client who relies on an MSP, these steps come first:

1. Disable the ConnectWise app IDs, but do not delete them. Keeping them intact preserves the records investigators will need.
2. Review every application in Microsoft Entra ID for credentials added since October 13, a step recommended in security reporting from [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/) and [Cybersecurity Dive](https://www.cybersecuritydive.com/news/connecwise-suspends-cloud-backup-hacker-microsoft-365/833345/).
3. Check mailbox forwarding rules, inbox rules and delegated access for changes nobody made.
4. Look for unexpected high-privilege grants, including Directory.ReadWrite.All, on any application in the tenant.
5. Limit who holds Application Administrator roles, and restrict how client secrets are created.

Disabling an app does not reverse changes already made in a tenant, so each change has to be reviewed and reversed on its own. If your provider used Cloud Backup, ask it directly which tenants were connected and whether any of your applications were touched. Get the answer in writing.

## What to watch next

Three things will decide how serious this becomes. The first is a dated restoration plan, which ConnectWise has prepared but not announced. The second is a root-cause explanation for the stolen API secret, which the company has not provided. The third is whether the 2028 credential claim holds up, since only one outlet has reported it. No U.S. government advisory had surfaced in the reporting reviewed for this story, so Microsoft’s Storm-0940 attribution remains the main official account.

The longer question is structural. MSPs and software vendors hold broad permissions across customer tenants because that is how these tools work, and this incident shows how much damage a single compromised app can carry. Expect more buyers to ask vendors how they store secrets, how often they rotate them and how quickly they can revoke them. Clients of MSPs will feel the cost first, and the next few weeks will show whether the service returns on a schedule anyone can plan around.

## Frequently asked questions

### Am I affected by the ConnectWise Cloud Backup breach?

You may be affected if your managed service provider used ConnectWise Cloud Backup, formerly SkyKick, to protect your Microsoft 365 data. Confirmed tenant counts reached 173 by October 17, and Huntress said its customers are mostly small and mid-sized businesses. Ask your provider whether it used Cloud Backup and whether any apps in your tenant connected to ConnectWise, then review your Microsoft Entra ID app list.

### When will ConnectWise Cloud Backup be restored?

ConnectWise has not announced a restoration date. In an October 20 update, the company said it had completed an account and credential reset and was preparing for phased restoration. A spokesperson has said there is no timeline yet.

### Who is behind the Storm-0940 campaign?

Microsoft attributed the activity to Storm-0940, a China-linked group, on October 22, 2026. Microsoft reported more than 2,250 Microsoft 365 tenants targeted, at times reaching about 2,900 attempts a minute. No U.S. government advisory had surfaced in the reporting reviewed for this story.

### Does disabling the ConnectWise apps fully stop the attack?

Disabling the apps cuts off that access path, but it does not reverse changes already made in a tenant. Attackers added credentials to other trusted apps, and previously issued tokens may stay valid until they expire. Cybernews reports credentials valid until 2028, a claim not confirmed elsewhere, so admins should audit every app for added credentials.

## Sources

1. [ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident, The Hacker News](https://thehackernews.com/2026/10/connectwise-resets-credentials-as-cloud.html)
2. [ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access, Help Net Security](https://www.helpnetsecurity.com/2026/10/19/connectwise-cloud-backup-suspended-security-incident/)
3. [ConnectWise customers hit by supply-chain attack linked to compromised API secret, CyberScoop](https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/)
4. [Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants, The Register](https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687)
5. [Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise, TechCrunch](https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/)
6. [ConnectWise suspends cloud services after attack, Paubox](https://www.paubox.com/blog/connectwise-suspends-cloud-services-after-attack)
7. [Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack, BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/)
8. [ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users, Cybersecurity Dive](https://www.cybersecuritydive.com/news/connecwise-suspends-cloud-backup-hacker-microsoft-365/833345/)
9. [ConnectWise breach puts more than 300 companies' secrets at risk, Cybernews](https://cybernews.com/security/connectwise-cloud-backup-breach-microsoft-365/)
10. [ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks, Huntress](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access)
11. [ConnectWise suspends Cloud Backup service after supply chain attack, The Record](https://therecord.media/connectwise-suspends-cloud-backup-service-supply-chain-attack)
12. [ConnectWise Cloud Backup Breach Hits 173 Tenants [2026], Tech-Insider](https://tech-insider.org/connectwise-cloud-backup-breach-173-tenants-2026/)