ConnectWise has suspended its Cloud Backup service, formerly SkyKick Cloud Backup, after confirming unauthorised access to application identities associated with the platform. Security researchers have confirmed malicious sign-ins to Microsoft 365 tenants using compromised application credentials, and affected organisations are being told to review their Microsoft 365 application identities and credentials urgently.
The incident matters because cloud backup applications are normally granted broad access to Microsoft 365 data such as Exchange Online mailboxes, OneDrive, SharePoint and Teams. If an attacker obtains a valid application credential, they may be able to request Microsoft Graph access tokens using the permissions already granted to that application.
ConnectWise says Cloud Backup is currently suspended while its investigation and remediation continue. Existing backup archives remain encrypted and isolated, and ConnectWise says it has no indication that those stored archives have been compromised.
What happened to ConnectWise Cloud Backup?
ConnectWise says it identified unauthorised access to application identities associated with ConnectWise Cloud Backup, previously known as SkyKick.
Huntress reported that a compromised credential belonging to the Cloud Backup application was used to obtain Microsoft Graph tokens in customer tenants. As of 16 October, Huntress had confirmed unauthorised sign-ins in at least 162 Microsoft 365 tenants.
ConnectWise subsequently disabled affected application identities and suspended Cloud Backup by revoking certificates used for affected application connections.
That action prevents new authentication through those credentials, but it does not automatically reverse changes that may already have been made inside an affected Microsoft 365 tenant.
Why is this different from a normal stolen password?
This incident involves application identities, not just an individual user's Microsoft 365 password.
Backup and management platforms use Microsoft Entra applications and service principals to access customer data. Those applications can have substantial permissions because they need to read or restore mailboxes, files, Teams data and other Microsoft 365 content.
If an attacker gains control of one of those application credentials, they can potentially authenticate as the trusted application itself. That means controls designed around normal user sign-ins, such as MFA, may not provide the same protection.
What should Microsoft 365 administrators check now?
If your organisation currently uses, or has previously used, ConnectWise Cloud Backup or SkyKick Cloud Backup, the tenant should be reviewed rather than assuming that suspension of the service has removed every risk.
- Review affected ConnectWise applications and service principals in Microsoft Entra.
- Check application sign-in logs for unusual activity from 15 October 2026 onwards, and follow ConnectWise's latest guidance for the precise review period.
- Review application credentials across the tenant for unexpected secrets or certificates added since 13 October.
- Check directory role assignments for unexpected additions such as Exchange Administrator or Global Administrator.
- Review Microsoft 365 audit activity for suspicious changes made by applications rather than normal users.
- Check Exchange inbox rules and related configuration for changes that were not authorised.
- Do not re-enable affected ConnectWise applications until ConnectWise confirms the credentials and services are safe to use again.
ConnectWise has published detailed technical guidance through its Trust Center and recommends that partners ensure the administrator responsible for every affected customer tenant receives the guidance.
Not sure whether your Microsoft 365 tenant is affected?
KES can review application identities, Entra sign-in activity, privileged role changes and suspicious application credentials in your Microsoft 365 environment.
Why disabling the application may not be enough
One of the most important warnings from Huntress is that simply disabling an affected Microsoft 365 application does not remove credentials that may already have been added elsewhere in the tenant.
Huntress observed one ConnectWise Cloud Management application assigning itself elevated privileges and then adding new credentials to other applications in a tenant.
That means an administrator should not stop after confirming that the original ConnectWise application is disabled. The wider application estate needs to be checked for newly added client secrets or certificates that could provide another route back into the tenant.
Were Microsoft 365 backup archives stolen?
At the time of writing, ConnectWise says it has no indication that hosted Cloud Backup archives have been compromised.
ConnectWise says existing backup archives remain encrypted and isolated. However, that statement relates specifically to the stored backup data and does not establish whether an organisation's live Microsoft 365 tenant was accessed.
Those are two separate questions: whether the backup archive itself was compromised, and whether the application's Microsoft 365 permissions were abused to access or modify data in the live tenant.
Which ConnectWise applications are involved?
ConnectWise has disabled seven affected application identities as part of its response. Huntress has also reported high-confidence abuse involving ConnectWise Cloud Management applications for services including Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Graph and Partner Center.
Businesses should use the ConnectWise Trust Center for the current list of affected application IDs and remediation guidance rather than relying on a static list copied elsewhere, because the investigation is still developing.
Does this affect every Microsoft 365 business?
No. The immediate risk is to organisations where the relevant ConnectWise or former SkyKick applications were consented in the Microsoft 365 tenant.
However, this incident is a useful reminder that third-party Microsoft 365 applications can hold powerful permissions. Businesses should know which applications have access to their tenant, what permissions they hold and whether those permissions are still required.
A periodic review of Microsoft 365 monitoring and security management should include application identities as well as user accounts.
What should businesses ask their IT provider?
If your Microsoft 365 environment is managed by an MSP or IT provider, ask them directly:
- Do we use ConnectWise Cloud Backup or the former SkyKick Cloud Backup?
- Were any affected ConnectWise applications present in our tenant?
- Have application sign-in and audit logs been reviewed?
- Have all Microsoft Entra application credentials added since 13 October been checked?
- Have unexpected directory role assignments been investigated?
- Has our provider documented whether our tenant was affected or not?
A clear answer should be based on tenant evidence, not simply on whether backups appear to be running.
Quick answers
Has ConnectWise Cloud Backup been breached?
ConnectWise has confirmed unauthorised access to application identities associated with Cloud Backup and has suspended the service while its investigation continues.
Was SkyKick affected?
Yes. ConnectWise Cloud Backup is the service formerly known as SkyKick Cloud Backup.
Can attackers access Microsoft 365 through a backup application?
A backup application may have broad Microsoft 365 permissions. If its application credential is compromised, an attacker may be able to request access tokens using those existing permissions.
Is disabling the ConnectWise application enough?
Not necessarily. Administrators should also review other applications for unexpected credentials and check for privilege or configuration changes already made in the tenant.
Were backup archives compromised?
ConnectWise says it currently has no indication that hosted Cloud Backup archives were compromised and says those archives remain encrypted and isolated.
Sources
