ConnectWise Cloud Backup suspended after attackers access 173 Microsoft 365 tenants

Attackers compromised a vendor-managed credential belonging to ConnectWise Cloud Backup — the backup service formerly known as SkyKick — and used it to sign in to 173 Microsoft 365 customer environments in a roughly two-and-a-half-hour window on October 15, 2026. ConnectWise shut off customer access to the service on October 17 and, as of October 19, Cloud Backup, SaaS Security, and Cloud Management all remain suspended with no confirmed restoration date.

The method is worth understanding. The stolen credential lived inside ConnectWise's own Microsoft 365 tenant, not inside any customer's environment. That means customer-side controls — multi-factor authentication, conditional access policies, conditional session rules — had no way to intercept the sign-ins. Microsoft has described the event as an active supply chain attack. Security firm Huntress, which first detected the activity, confirmed that in at least one tenant a second ConnectWise application escalated to the Global Administrator role and added new credentials set to expire in 2028, a persistence mechanism designed to survive the initial cleanup. ConnectWise says existing backup archives remain encrypted and isolated, and that there is no evidence the archived data itself was accessed.

For any organization whose Microsoft 365 backup runs through ConnectWise Cloud Backup, no new backups are being taken and restores are unavailable for the duration of the outage. It is worth reviewing what native retention is configured directly in Exchange Online, OneDrive, and SharePoint to understand the current gap. Organizations should also check Microsoft Entra service principal sign-in logs for the ConnectWise Cloud Backup application ID (506e08f9-6e9a-4da4-942b-a099a03644ae) and review any recent OAuth credential changes or unexpected permission grants. ConnectWise is publishing updates through its Trust Center at connectwise.com/company/trust/advisories.