GoKawiilConnectWise disables Cloud Backup access after hackers compromise Microsoft 365 tenants
ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers gained access to application identities used to connect to Microsoft 365 tenants. Microsoft confirmed unauthorized authentication attempts from an IP address on October 15, while security firm Huntress identified at least 162 compromised tenants in its own environment. ConnectWise says it has found no evidence that customer backup data itself was accessed, and existing backups remain intact.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how a single compromised service provider can ripple out to affect many downstream Microsoft 365 customers, since MSP tools like Cloud Backup hold broad permissions across client tenants via Entra ID service principals. The scale reported by Huntress suggests the breach may extend beyond what ConnectWise has publicly disclosed so far, and the investigation's outcome could determine how much trust MSPs retain in supply-chain-dependent backup tools.
- ConnectWise disabled application access to its Cloud Backup service after detecting unauthorized access to application identities.
- Microsoft and Huntress independently confirmed malicious activity, with Huntress counting at least 162 compromised Microsoft 365 tenants.
- ConnectWise states no evidence yet shows customer backup data was compromised, and existing archives remain accessible once service resumes.
YubiKey 5C NFC Security Key — With supply-chain breaches compromising Microsoft 365 tenants via stolen application identities, strengthening account security with hardware-based MFA is more important than ever. A YubiKey adds a physical layer of authentication that's much harder for attackers to bypass than passwords or app-based tokens. It's a simple, practical step IT teams and individuals can take to reduce the risk of unauthorized access.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-17
Published there as: “Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.