Skykick - GoKawiil

ConnectWise Disables Cloud Backup Product After Microsoft 365 Credential Breach

ConnectWise disclosed that a threat actor used credentials tied to its Cloud Backup product (formerly SkyKick) to authenticate into Microsoft 365 tenants, discovering unauthorized access to application identities on Oct. 14. The company has since disabled Cloud Backup, SaaS Security, and Cloud Management for partners and clients while an incident response firm investigates, leaving backup, restore, and monitoring functions unavailable.

darkreading.com · 2026-10-19

ConnectWise disables Cloud Backup access after hackers compromise Microsoft 365 tenants

ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers gained access to application identities used to connect to Microsoft 365 tenants. Microsoft confirmed unauthorized authentication attempts from an IP address on October 15, while security firm Huntress identified at least 162 compromised tenants in its own environment. ConnectWise says it has found no evidence that customer backup data itself was accessed, and existing backups remain intact.

bleepingcomputer.com · 2026-10-17