# Compromised ConnectWise Credential Opens 173 Microsoft 365 Tenants

- URL: https://usa-24.com/connectwise-cloud-backup-breach/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-17T21:37:00.991Z
- Updated: 2026-10-17T21:37:00.999Z
- Topics: Cybersecurity, Microsoft 365, Supply Chain Attacks, Managed Service Providers, OAuth Apps

> A compromised vendor credential for ConnectWise Cloud Backup let attackers sign in to 173 Microsoft 365 tenants without a password or MFA prompt. Here is what admins should check.

## Key takeaways

- Attackers signed in to at least 173 Microsoft 365 partner and customer tenants using a compromised ConnectWise Cloud Backup vendor credential, without a user password or MFA prompt.
- The confirmed count rose from 162 tenants as of 19:00 UTC on October 16 to 173 as reporting spread on October 17.
- Token requests came from IP 144.172.64.128 between 06:13 and 08:34 UTC on October 15, according to a researcher quoted by The Hacker News.
- Attacker-added client secrets were reported valid into 2028, and revoking user sessions alone does not end the access.
- ConnectWise suspended Cloud Backup application access until further notice, and the sources reviewed give no restoration date.

The ConnectWise Cloud Backup breach reached at least 173 Microsoft 365 partner and customer tenants through one compromised vendor credential. The attackers did not need a user password or a multifactor authentication prompt. The credential belonged to ConnectWise Cloud Backup, the product formerly known as SkyKick Backup, which protects Microsoft 365 and Google Workspace data for managed service providers.

Huntress, which first reported the campaign, confirmed unauthorized sign-ins as of October 15. Because the abused secret sits with a vendor that MSPs rely on, any US firm that consented the app could be exposed. ConnectWise has shut off the application while it investigates, and it said its investigation found no evidence that partner backup data itself was compromised.

## What happened in the ConnectWise Cloud Backup breach

Reporting started October 16 and went wide on October 17. Huntress said the confirmed count rose from 162 tenants to 173, according to [SparTech Software](https://www.spartechsoftware.com/cybersecurity-news/connectwise-backup-breach-173-tenants/). The timeline below combines the dates reported across the sources.

| When (2026) | What the sources report |
|---|---|
| Oct. 13 and 14 | One IP address password-sprayed four law-firm tenants. No successful user sign-ins were linked to that activity. |
| Oct. 15, 06:13 to 08:34 UTC | Attackers requested Microsoft Graph tokens from IP 144.172.64.128. |
| Oct. 16, 19:00 UTC | Huntress had confirmed 162 affected tenants. |
| Oct. 17 | The count reached 173 and coverage spread widely. |
| No date given | ConnectWise suspended Cloud Backup application access until further notice. |

The token requests came from a hosting-provider address. A researcher quoted by [The Hacker News](https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html) put the problem plainly: "The app's credential is in hostile hands," said security researcher Jonathan Semon. Tenants were hit in sorted GUID order, seconds apart, which suggests automated scripting against a target list, according to [Rod Trent's security check-in](https://rodtrent.substack.com/p/security-check-in-quick-hits-m365).

## Why one vendor credential reached so many Microsoft 365 tenants

The abused secret was a vendor-side client assertion credential, not a password that individual customers held. That detail explains the reach. The ConnectWise application already had consent in each customer tenant, so the stolen access worked anywhere the app held permissions.

Those pre-consented permissions gave read and write access to mailboxes through Exchange Web Services. They also reached OneDrive and SharePoint files, Teams chats and directory data, and none of it triggered an MFA challenge, according to The Hacker News and Rod Trent's check-in.

The escalation went further in at least one tenant. A related ConnectWise application granted itself Global Administrator and added new client secrets to an MSP management app and a Huntress application, according to [daily.dev](https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow). Attacker-added secrets were reported valid into 2028, so resetting the first credential would not finish the job on its own.

Coverage repeatedly describes the underlying problem as structural. A single trusted multitenant app with broad permissions can reach every tenant that consented to it. The MSP model multiplies that exposure, because one vendor sits between many firms and their Microsoft 365 data.

## Which Microsoft 365 tenants face the most risk

US managed service providers and the Microsoft 365 customers they support are the most exposed group. The app is consented into customer tenants, and MSP management apps may be affected too. An MSP compromise can therefore become a customer compromise in a single step.

Individual consumers are not directly affected unless their business uses this MSP or backup stack. A company that outsources IT should ask its provider whether it uses ConnectWise Cloud Backup and whether the app is consented in its tenant.

Law firms have a specific reason to pay attention. Huntress reported that a single IP address password-sprayed four law-firm tenants on October 13 and 14, according to [Memesita](https://www.memesita.com/connectwise-credential-breach-affects-173-microsoft-365-tenants/). No successful user sign-ins were linked to that spraying, and the sources reviewed do not tie it to the token activity.

## How to check whether your Microsoft 365 tenant was hit

The most useful checks look at the app identity itself, not only at people. Standard user sign-in reviews can miss this activity.

- Review Microsoft Entra service principal sign-in logs, not only user sign-ins, for activity from 144.172.64.128.
- Audit credentials and role assignments added since October 13, 2026. Huntress and Todyl both recommend that starting window.
- Look for ConnectWise or SkyKick apps that have granted themselves directory roles, and check MSP management apps for new client secrets.
- Enable Microsoft Graph activity logs so token use is recorded. Huntress cautioned that the lack of visible mail activity may complicate detection.

Record every finding before you change anything. An intact audit trail will help you confirm the scope later.

## Disabling the ConnectWise Cloud Backup app without leaving a gap

The guidance from researchers and vendors is consistent. Disable the ConnectWise Cloud Backup application in your tenant rather than deleting it. Do not re-enable it until ConnectWise confirms credential resets. The sources reviewed do not say when ConnectWise will restore the service or confirm those resets.

Disabling the app is only part of the response. Organizations that revoke user sessions alone do not end this access, according to Todyl. Nicholas Koken of Todyl said tokens already issued can stay valid for up to 90 minutes after an app is disabled in a tenant, per [Memesita](https://www.memesita.com/connectwise-credential-breach-affects-173-microsoft-365-tenants/). Plan for that window, and pair the disable step with the credential and role audit described above.

## What the reports still do not know

Several basic questions remain open. Huntress has not attributed the campaign to a named actor. Reports describe access and token use, but they do not confirm that mail or files were stolen. Huntress cautioned that the missing mail activity may slow detection, which makes the data question harder to answer quickly.

How the credential leaked is also unresolved. [Cybersecurity News](https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/) suggests poor access management or phishing, but it found no evidence that ConnectWise itself was breached. Treat that as an inference, not a confirmed finding.

The Hacker News also tied a separate software supply-chain compromise, which ran from April to July 2026, to a previously undocumented cluster called UNC7017. The article did not say whether UNC7017 is connected to this campaign.

## What to watch next

Three developments will shape the story in the coming weeks. The first is whether ConnectWise publishes a restoration date and confirms credential resets, because that decides when MSPs can safely re-enable the application. The second is whether Microsoft Threat Intelligence, which says it is tracking an active supply-chain attack involving the trusted OAuth app, publishes indicators beyond a single IP address. The third is whether the tenant count moves again, since it already climbed from 162 to 173 in a day.

The pattern also looks familiar. Trusted software that reaches many systems through one weak point is the shape of the [AOMEI Backupper backdoor that hit Windows users through tampered updates](https://usa-24.com/aomei-backupper-backdoor-update-attack/). Vendor-held remote access raises similar stakes, as the [BeyondTrust zero-day advisory](https://usa-24.com/beyondtrust-remote-support-zero-day/) shows with its patch-now, then-rebuild guidance.

For MSPs, the test this week is straightforward. List every consented app that can reach customer mail and files, and confirm who would be notified if one of them changed.

## Frequently asked questions

### What is the ConnectWise Cloud Backup breach?

Attackers used a compromised vendor credential for ConnectWise Cloud Backup, formerly SkyKick Backup, to sign in to at least 173 Microsoft 365 partner and customer tenants. Huntress first reported the activity, and it confirmed unauthorized sign-ins as of October 15. The attacker has not been identified.

### Do I need to act if my company does not run an MSP?

Individual consumers are not directly affected unless their business uses this managed service provider or backup stack. If your company outsources IT, ask the provider whether it uses ConnectWise Cloud Backup and whether that app has consent in your Microsoft 365 tenant.

### How do I check whether ConnectWise Cloud Backup touched my Microsoft 365 tenant?

Review Microsoft Entra service principal sign-in logs for activity from IP address 144.172.64.128. Then audit credentials and role assignments added since October 13, 2026, and check whether any ConnectWise or SkyKick app has granted itself directory roles.

### Will resetting passwords or revoking sessions stop the attack?

Not on their own. The abused secret was a vendor-side credential, not a password held by customers, and Todyl says revoking user sessions alone does not end the access. Disable the application without deleting it, and do not re-enable it until ConnectWise confirms credential resets.

## Sources

1. [Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants](https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html)
2. [ConnectWise Backup Breach Hits 173 Microsoft 365 Tenants](https://www.spartechsoftware.com/cybersecurity-news/connectwise-backup-breach-173-tenants/)
3. [Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts](https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/)
4. [ConnectWise Credential Breach Affects 173 Microsoft 365 Tenants](https://www.memesita.com/connectwise-credential-breach-affects-173-microsoft-365-tenants/)
5. [ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks](https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow)
6. [Security Check-in Quick Hits: M365 Tenant Compromises](https://rodtrent.substack.com/p/security-check-in-quick-hits-m365)
7. [One Compromised Vendor Credential, 173 Microsoft 365 Tenants](https://coesecurity.com/one-compromised-vendor-credential-173-microsoft-365-tenants-the-growing-risk-of-cloud-supply-chain-attacks/)