A compromised credential belonging to a trusted cloud backup application has allowed attackers to access Microsoft 365 environments across multiple organizations. Security researchers have confirmed unauthorized activity in more than 170 customer and partner tenants, raising fresh concerns about the risks of third-party software integrations.
A cybersecurity incident involving ConnectWise Cloud Backup has exposed a serious weakness in the way organizations grant access to external cloud applications. Attackers obtained a credential belonging to the backup service and used it to authenticate against Microsoft 365 environments where the application had already been authorized.
The attack is particularly concerning because it did not depend on stealing each customer’s password. Instead, the attackers abused the identity of a trusted application, inheriting permissions that organizations had previously granted to the legitimate backup service.
On October 17, 2026, cybersecurity reporting cited Huntress findings of unauthorized sign-ins across 173 Microsoft 365 partner and customer tenants. ConnectWise confirmed unauthorized access involving application identities in its Cloud Backup environment and suspended the service while investigating. Microsoft also confirmed that it was tracking the activity as a supply-chain attack.
Sources: Huntress investigation, BleepingComputer report.
How the attack worked
ConnectWise Cloud Backup, formerly known as SkyKick Cloud Backup, is designed to help managed service providers protect and restore customer data stored in Microsoft 365 and other cloud services. To perform that job, the application requires substantial permissions to access information such as email, OneDrive files, SharePoint documents and Microsoft Teams data.
According to security researchers, attackers obtained a credential associated with the application’s identity. On October 15, the compromised credential was used to authenticate against customer Microsoft 365 tenants from an external hosting-provider IP address.
The application was already trusted by those environments. As a result, the attacker could request access tokens using permissions previously granted to the legitimate application. This created a dangerous situation: authentication could succeed without the attacker needing to log in as an individual employee.
Huntress reported that the observed activity moved through customer tenants in a highly automated sequence. Microsoft also identified follow-on activity involving reconnaissance and attempts to add credentials to related application identities, potentially allowing continued access.
The findings show why protecting application credentials is just as important as protecting usernames and passwords. An attacker who steals a powerful service identity may gain access to many organizations through a single compromise.
More than 170 Microsoft 365 tenants affected
Huntress initially reported confirmed unauthorized sign-ins in 162 tenants. Subsequent reporting on October 17 cited 173 tenants. These figures reflect observations at different points in an ongoing investigation and should not be interpreted as a final count of every affected organization.
The number of tenants with confirmed unauthorized authentication is also different from the number of organizations that may have been exposed. Any environment that had authorized the affected application could potentially have been targeted, although the presence of the application alone does not prove that an attacker accessed that particular tenant.
The potential impact is significant because Microsoft 365 often contains sensitive business information. Depending on the permissions granted, access could extend to email messages and attachments, SharePoint documents, OneDrive files, Teams information and directory data.
At the time of the reported findings, researchers had confirmed unauthorized application sign-ins. The precise amount of customer information read, copied or otherwise accessed remained difficult to establish from authentication logs alone.
Was customer data stolen?
This is one of the most important questions surrounding the incident, and the distinction between potential access and confirmed data theft matters.
Security researchers confirmed that the compromised application identity authenticated to customer environments using previously granted permissions. Those permissions could provide access to substantial amounts of information, but successful authentication does not by itself prove that every accessible file or mailbox was downloaded.
ConnectWise separately stated that its stored Cloud Backup archives remained encrypted and isolated and that it had no evidence those archives had been accessed. However, the company explained that its investigation could not independently determine whether unauthorized activity had occurred inside downstream customer Microsoft 365 environments.
In other words, the absence of evidence that the backup archives were accessed does not establish that live customer data was safe. Organizations must review their own Microsoft 365 audit and sign-in records to determine whether their environments were affected.
ConnectWise shuts down Cloud Backup access
ConnectWise took protective action by suspending Cloud Backup service and revoking certificates used for affected application connections. The company said the shared credentials previously used for those connections were no longer valid.
The shutdown was intended to prevent further use of the affected connections while the investigation and remediation continued. It also interrupted backup and restoration services for customers who depended on the product.
ConnectWise said existing backup archives remained preserved, but access to those archives and restoration capabilities was unavailable during the service interruption. The company engaged an external incident-response firm and continued investigating its wider environment.
The incident highlights a difficult challenge for cloud security providers: emergency containment can prevent additional unauthorized access, but it can also temporarily disrupt services that customers rely on for business continuity.
Organizations using the affected service should follow the latest guidance from ConnectWise and their security providers before restoring integrations or assuming normal operations have resumed.
Official advisory: ConnectWise Trust Center.
What organizations should do now
Organizations that use ConnectWise Cloud Backup should treat the incident as a priority security investigation. Microsoft 365 administrators and managed service providers should review service-principal sign-in logs, investigate unexpected authentication sources and examine application permission changes around the dates identified by researchers.
ConnectWise and security researchers have published specific indicators to help defenders investigate the activity. One reported suspicious IP address is 144.172.64.128. Microsoft Entra administrators should review the service-principal sign-in logs for the affected Cloud Backup application rather than relying only on ordinary user sign-in records.
Administrators should also examine application credentials, OAuth permissions and directory-role assignments for unexpected changes. Disabling a compromised application can stop new authentication through that integration, but it may not remove credentials that an attacker has already added elsewhere. Organizations should follow current vendor and incident-response guidance to identify and remove unauthorized persistence safely.
Do not delete backup archives or remove integrations blindly without understanding the consequences. ConnectWise has advised partners to disable affected application identities rather than delete them, and to coordinate with their security teams. Customers should also confirm backup retention and restoration arrangements while the service remains disrupted.
The incident does not mean every Microsoft 365 customer has been compromised. It does mean that organizations with the affected application should verify their exposure rather than assume they are safe because no obvious signs of intrusion have appeared.
Why supply-chain attacks are becoming so dangerous
Cloud services increasingly depend on applications that connect different platforms and automate business processes. Backup tools, monitoring systems, help-desk integrations and management applications often require broad access to perform their intended functions.
That creates a concentration of risk. A single compromised credential can potentially provide access to multiple customer environments, particularly when the same application identity has been authorized across many tenants.
Traditional security advice focuses heavily on protecting individual accounts with strong passwords and multifactor authentication. Those measures remain important, but they do not necessarily prevent an attacker from abusing a compromised application credential.
Organizations also need to inventory third-party applications, limit permissions where practical, protect secrets, monitor service-principal activity and regularly review whether integrations still require their existing access. Vendors, meanwhile, must secure their own credentials and infrastructure with the same care expected of the customer environments they protect.
The ConnectWise incident is a reminder that trust is not a substitute for monitoring. An application can be legitimate, widely deployed and essential to daily operations while still becoming a route for attackers if its identity is compromised.
Final verdict: one compromised credential, many potential victims
The ConnectWise Cloud Backup incident demonstrates how a supply-chain attack can bypass the usual focus on individual user accounts. By abusing a trusted application’s identity, attackers gained unauthorized authentication in more than 170 reported Microsoft 365 tenants.
ConnectWise has suspended the affected service and revoked the compromised application credentials, while Microsoft and security researchers continue investigating the activity. The full extent of any access to customer information remains a key question, and organizations should not confuse the protection of stored backup archives with proof that live Microsoft 365 environments were unaffected.
For businesses, the lesson is clear: third-party application identities deserve the same scrutiny as privileged user accounts. Review permissions, monitor service-principal activity and verify what happened before restoring trust.
H4CK.SE security takeaway: A supply-chain attack does not need to compromise every company individually. When one trusted application has access to many organizations, a single stolen credential can become a much larger security incident.
