ConnectWise Breach: What the Cloud Backup (SkyKick) Hack Means for Microsoft 365

Update (October 19, 2026): ConnectWise’s latest Trust Center updates (October 18, 18:45 UTC and October 19, 01:15 UTC) add two new attacker IP addresses, 144.172.64.99 and 144.172.64.60, alongside 144.172.64.128. Cloud Backup, SaaS Security and Cloud Management are still suspended, with “no confirmed restoration time” yet; ConnectWise says it has “not observed successful threat activity” since its mitigations and will post its next update by October 19, 13:00 UTC. Keep the apps disabled until ConnectWise publishes formal restoration instructions.

Last updated: October 19, 2026. By Veer. Facts checked against the ConnectWise Trust Center advisory (updates through October 19, 01:15 UTC), Huntress’s running investigation (updates through October 17, 5:15 PM ET), Todyl’s investigation (October 16), Microsoft Threat Intelligence’s statement as quoted by The Hacker News, and BleepingComputer. This is a developing story; we’ll update this page as ConnectWise publishes restoration steps or a root cause.

If you work at a managed service provider (MSP), or your company’s IT is run by one, this is the security story to act on this weekend. Below is what happened, who is actually exposed, the exact apps to look for, and the checks ConnectWise, Huntress and Microsoft recommend. Everything here comes from the vendors’ and researchers’ own posts; we haven’t run these checks in a tenant ourselves.

What happened in the ConnectWise breach?

Attackers got hold of a credential that ConnectWise Cloud Backup uses to talk to Microsoft 365, then used it to request access tokens in customers’ tenants as if they were the backup service. ConnectWise describes it as “unauthorized access to application identities within the ConnectWise Cloud Backup environment.” Microsoft Threat Intelligence called it an “active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup.”

Cloud Backup (sold as SkyKick Cloud Backup before ConnectWise renamed it) is a multi-tenant Microsoft 365 app. When a tenant admin approves it, the app gets application permissions so it can back up and restore data without anyone signing in. Huntress points out that this one vendor credential “works against every tenant the app is consented in,” so an attacker holding it isn’t limited to one customer.

According to Huntress, the credential was used to get Microsoft Graph tokens from the IP address 144.172.64.128 on October 15, between 06:13 and 08:34 UTC, moving through tenants “in sorted GUID order, a few seconds apart,” which points to a script working from a list. Todyl saw the same pattern in the tenants it monitors, between 07:11 and 08:47 UTC.

Who is affected by the ConnectWise Cloud Backup hack?

Any organization that has the ConnectWise Cloud Backup (SkyKick) app approved in its Microsoft 365 tenant should treat itself as exposed, including tenants where the app sits unused. Todyl went further, writing that “we can assume ALL tenants” with the app enabled “are compromised.” ConnectWise asks partners to check “each managed customer tenant, including environments with dormant SkyKick connections.”

That means three groups should pay attention:

• MSPs and IT providers that use ConnectWise Cloud Backup, Cloud Management or SaaS Security for clients.
• Businesses whose MSP set up SkyKick backup for their Microsoft 365, even years ago. One Reddit admin quoted by BleepingComputer got a Privileged Identity Management alert on October 15 that a SkyKick app had given itself Exchange Administrator “despite not using the app in years.”
• Microsoft 365 tenants that never used ConnectWise but were probed anyway. Huntress saw a second, targeted wave on October 15 against 16 tenants in the “policy, national security, trade, and critical mineral sectors.” Most of those didn’t use ConnectWise products, and the attempts failed where the app wasn’t present.

Consumers with personal Microsoft accounts aren’t in scope. This is about business tenants.

How many tenants were hit?

These numbers come from security vendors’ own customer fleets, so the true total is unknown. ConnectWise hasn’t published a victim count.

What could the attacker access?

Whatever the backup app was allowed to touch, which is a lot: mail and attachments, OneDrive and SharePoint files, Teams chats and directory data, with write access for restores. Todyl says the app’s consent “permits read/write access to mail and attachments (full mailbox access through Exchange Web Services), OneDrive and SharePoint files, and Teams chats, including the ability to restore data.” Microsoft says the attacker likely abused permissions customers had already granted, “including highly privileged permissions like Directory.ReadWrite.All.”

Two details make this worse than a normal leaked password:

1. MFA and user sign-in policies don’t apply. These are app-only sign-ins with no user, so there’s no MFA prompt. Todyl notes that revoking user sessions “does not end this access,” and that Conditional Access can’t be applied to third-party multi-tenant apps.
2. Some reads leave no trail. Huntress warns that “directory reads through Microsoft Graph leave no audit trail,” so its current verdict for many tenants is “tokens issued, nothing visible taken.” Todyl adds that where a tenant really uses the backup service, attacker reads and legitimate backup reads look the same in standard audit logs unless Microsoft Graph activity logs were already turned on.

Did attackers create backdoors?

In at least one tenant, yes. Huntress found that on October 15, between 03:44 and 03:49 UTC, the ConnectWise Cloud Management – MS Teams app added itself to Global Administrator, then used a Python script to add new client secrets to two other apps in that tenant: an MSP management tool and Huntress’s own security app. Those secrets were set to expire in 2028. Huntress removed the credential on its app on October 16.

Microsoft separately observed “attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor.” Todyl, by contrast, found no new secrets, apps, consents or role changes in the tenants it monitors. So the behavior varied by tenant, and you have to check yours.

Is my backup data safe?

ConnectWise says its stored archives are “encrypted, isolated, and preserved” and that it has “no evidence that these archives have been accessed.” But that says nothing about your live Microsoft 365 data. The company is explicit that it “cannot make that determination” for customer tenants, because Cloud Backup “does not provide the downstream security visibility” to see what happened inside them.

Right now, per the October 18 update:

ConnectWise also warns that “new or changed data may therefore fall outside existing backup recovery points.” If your only Microsoft 365 backup is Cloud Backup, you currently have a growing gap.

What should you do right now?

Disable every ConnectWise and SkyKick app in each tenant (don’t delete them), save your logs, then hunt for added credentials, roles and mailbox rules. This combines the steps from ConnectWise, Huntress and Todyl.

1. Disable the apps, don’t delete them

In the Microsoft Entra admin center, go to Enterprise applications → All applications, search by Application ID, open Properties and set Enabled for users to sign-in? to No. Huntress says deleting removes the consent, so you’d have to re-consent to restore service. ConnectWise says it disabled these seven identities on its side at 07:00 UTC on October 17, but asks you to verify each one locally, because “a vendor action and a customer-tenant setting are different controls.”

Source: ConnectWise Trust Center and Huntress. Match on Application ID, not display name. If the ID doesn’t show up, Huntress suggests removing the “Enterprise Application” filter and searching again.

Disabling stops new tokens, but Todyl says tokens already issued “stay valid for up to 90 minutes.”

2. Export logs before they expire

ConnectWise notes Entra keeps audit and sign-in logs for 7 days on Entra ID Free and 30 days on P1/P2, and “a license upgrade does not recover expired history.” Since the activity started around October 13–15, Free tenants are close to losing it. Export audit logs and each sign-in category (user, non-interactive, service principal, managed identity) now, plus Microsoft Purview audit records.

3. Check service principal sign-ins

Go to Monitoring → Sign-in logs and open the Service principal sign-ins tab (the default User sign-ins tab won’t show this). Filter by each Application ID above and look for 144.172.64.128, 144.172.64.99 and 144.172.64.60 (the last two were added by ConnectWise on October 18), or any address outside Microsoft/Azure ranges. The app’s normal traffic comes from Azure private IPv6. ConnectWise recommends reviewing from October 13 onward and back to October 1 where you have records.

Published indicators so far include the user agents Python-urllib/3.12, python-requests/2.31 and python-requests/2.34.2, and curl/7.88.1 for earlier password spraying. ConnectWise cautions these tools are also used by real admins, so a match “does not prove compromise.”

4. Audit app credentials, roles and consent

• Review client secrets, certificates and federated credentials on every Enterprise application and App registration, especially security and management tools. Remove anything added since October 13 that you didn’t create. Huntress stresses that disabling the ConnectWise apps “will not remove credentials that were already added.”
• In Roles and administrators, look for apps holding Global Administrator, Privileged Role Administrator, Exchange Administrator or similar roles you didn’t grant.
• In Audit logs, look for “Add service principal credentials,” “Add member to role,” consent grants and Conditional Access policy changes.
• Check Conditional Access exclusions. Huntress notes that if a policy excludes this app, the attacker’s infrastructure won’t be blocked there.

5. Check mailboxes for forwarding and hidden rules

ConnectWise recommends searching Purview Audit for New-InboxRule, Set-InboxRule, Set-Mailbox, Add-MailboxPermission, Add-RecipientPermission and transport-rule changes, and using Get-InboxRule -Mailbox <mailbox> -IncludeHidden to catch hidden rules.

6. Turn on Microsoft Graph activity logs

Todyl recommends enabling them (needs Entra ID P1/P2). They aren’t retroactive, but without them you can’t tell an attacker’s Graph requests from the real app’s.

7. Report and plan for the backup gap

Send findings (tenant and app IDs, UTC times, correlation IDs, no secrets) to ConnectWise at SecurityPartnerSupport@ConnectWise.com, and don’t re-enable the apps until ConnectWise confirms all credentials are reset. Meanwhile, decide whether you need a temporary second backup for critical mailboxes and files.

What if I’m a small business, not an IT admin?

Ask your IT provider one question today: “Do we use SkyKick or ConnectWise Cloud Backup for Microsoft 365, and have you done the ConnectWise checks on our tenant?” You don’t need to run the steps above yourself. Your email, files and Teams keep working while the app is disabled; Huntress says only automated backups pause.

Do watch for phishing. Breach headlines are a common hook for fake “verify your account” emails, the same pattern we flagged after the Stop & Shop cyber attack. And remember that this attack went around MFA by abusing an app, not a person, which is why app permissions matter as much as the type of 2FA you use.

Was this caused by a ConnectWise vulnerability?

Not established. ConnectWise’s FAQ says its investigation “identified compromised application identities” and that “whether a product vulnerability contributed has not been established. The original credential-exposure mechanism remains under investigation.” There’s no CVE and no patch. The fix is on the tenant side: disable, audit, clean up.

This isn’t ConnectWise’s first serious incident, which is why “connectwise breach 2025” also shows up in searches. In May 2025, ConnectWise disclosed suspicious activity tied to a suspected nation-state actor that affected a very small number of ScreenConnect remote-access customers. That was a separate product and a separate incident.

ConnectWise breach timeline

While you’re reviewing Microsoft 365, it’s a good moment to finish this month’s other patching: the October 2026 Patch Tuesday fixes and the exploited Ivanti Connect Secure vulnerability. For upcoming Windows and Office cutoffs, see our Windows end of support calendar.

FAQ

What is the ConnectWise breach?

It’s an October 2026 supply-chain attack in which an attacker obtained the credential used by ConnectWise Cloud Backup (formerly SkyKick) and used it on October 15 to sign in to customers’ Microsoft 365 tenants as the backup app. ConnectWise disclosed it on October 16 and suspended the service.

Is SkyKick the same as ConnectWise Cloud Backup?

Yes. ConnectWise Cloud Backup is the former SkyKick Cloud Backup, and older tenants may still show the apps under SkyKick names such as SkyKick Cloud Manager. Search by Application ID rather than name.

Was my Microsoft 365 data stolen?

Nobody can say for sure yet. Huntress confirmed unauthorized sign-ins in at least 162 tenants, but some Microsoft Graph reads leave no audit trail. ConnectWise says it can’t see inside customer tenants, so each organization has to review its own logs.

Does MFA protect against this attack?

No. The attacker signed in as an application, not a user, so there was no MFA prompt and user Conditional Access policies didn’t apply. Disabling the app and removing unauthorized credentials are the controls that matter.

Should I delete the ConnectWise or SkyKick app?

No. Huntress and ConnectWise both say to disable the apps and preserve them as evidence. Deleting removes the consent, so you’d have to re-consent later, and it can destroy useful configuration history.

When will ConnectWise Cloud Backup come back online?

ConnectWise hasn’t given a date. Its October 19 update says it has no confirmed restoration time yet and will share a timeline once it can do so reliably; until then, scheduled backups, archive access and restores remain unavailable.

Sources

• ConnectWise Trust Center: Cloud Backup (formerly SkyKick) Service Interruption (published October 16, 17:47 UTC; updated October 17 05:01 and 17:00 UTC, October 18 01:00, 16:00 and 18:45 UTC, October 19 01:15 UTC)
• Huntress: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks (October 16, updated October 17)
• Todyl: Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App (October 16)
• The Hacker News: Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants (October 17; quotes Microsoft Threat Intelligence)
• BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (October 17)
• BleepingComputer: ConnectWise breached in cyberattack linked to nation-state hackers (May 2025 ScreenConnect incident)