ConnectWise Cloud Backup Breach Exposes Microsoft 365 Tenants

Erik Berg

October 20, 2026 4 min read

Executive Summary

The ConnectWise Cloud Backup breach let an attacker sign in to customer Microsoft 365 tenants on 15 October 2026 with a stolen credential belonging to the backup service formerly sold as SkyKick. unauthorised sign-ins were confirmed in 162 tenants by the following evening and later counted almost 1,000 tenants with sign-in activity from the attacker’s address, more than 300 of them successful. Microsoft calls it an active supply chain attack. ConnectWise suspended Cloud Backup on 17 October and says it has no indication that stored backups were compromised. A day later, scheduled backups still weren’t running. No Nordic victim has been named.

How the ConnectWise Cloud Backup Credential Opened Customer Tenants

ConnectWise Cloud Backup copies mail, OneDrive, SharePoint and Teams data for managed service providers (MSPs) and their clients; ConnectWise bought it with SkyKick in 2024. Each customer consents the app into its Microsoft Entra ID tenant as a service principal, the identity an application uses to act without a signed-in user. According to Todyl’s investigation, the attacker presented the app’s own secret through the OAuth client credentials flow and received app-only tokens for Microsoft Graph. No user was involved. MFA and user Conditional Access policies never came into play.

The sign-ins were traced to 144.172.64[.]128, a hosting address between 06:13 and 08:34 UTC. Tenants were hit in sorted GUID order a few seconds apart which reads as a script working down a target list. Where the ConnectWise service principal wasn’t present, Huntress says the attempts failed.

Global Administrator in Five Minutes

In one customer tenant a second ConnectWise app, Cloud Management for Microsoft Teams, added itself to the Global Administrator role at 03:44 UTC on 15 October. Within about five minutes it had planted new client secrets on two other applications including an MSP management tool and Huntress’s own security platform app. The secrets were set to expire in 2028. By 19 October Huntress had found a second tenant with the same pattern. Microsoft separately reported Graph reconnaissance and attempts to add credentials as a backdoor.

Todyl saw less. In the nine tenants it reviewed, it found sign-ins only.

Huntress also logged a targeted wave from the same address that day against 16 tenants in the policy, national security, trade and critical-minerals sectors. Most didn’t use ConnectWise products. Those attempts failed.

Backups Off While Planted Credentials Stay

ConnectWise disabled seven application identities on 17 October. In an update at 01:00 UTC the next day it said scheduled backups were not running, restores were unavailable and its SaaS Security and Cloud Management services were offline. Tokens issued before the shutdown may stay usable until they expire, the company said; Todyl puts that at up to 90 minutes.

Switching the apps off doesn’t remove anything already planted. Huntress tells administrators to review secrets and certificates on every application for additions since 13 October and to disable the ConnectWise apps rather than delete them. Where a customer confirms a significant incident, the Swedish NIS2 law requires an early warning within 24 hours, as our Svedala report set out.

Open Questions for ConnectWise

ConnectWise hasn’t said how the credential was stolen, how many of its customers are affected or when the credential was rotated. It has also said it has no view into customer tenants and can’t tell whether any single one was accessed. Data theft can’t be ruled out: Huntress notes that directory reads through Microsoft Graph leave no audit record. CERT-SE’s weekly newsletter of 16 October didn’t mention the incident.

This is ConnectWise’s second disclosed breach in 17 months. On 28 May 2025 the company reported suspicious activity it tied to a nation-state actor, affecting a very small number of ScreenConnect customers. No source links the two incidents.

A Seven-Day Window for Entra ID Free Tenants

Todyl notes that tenants on Entra ID Free keep sign-in logs for seven days. The malicious sign-ins in the ConnectWise Cloud Backup breach came on the morning of 15 October. In those tenants the records age out on 22 October. Graph activity logs which separate an attacker’s reads from the backup service’s own, need a P1 or P2 licence and don’t apply retroactively. A Swedish company that finds personal data was reached has 72 hours to notify IMY under GDPR Article 33. Without those logs, the sign-in record is the only trace of the attacker.