Microsoft - Data Breach
Executive Summary
Hackers exploited ConnectWise's Cloud Backup service to gain unauthorized access to at least 162 Microsoft 365 tenants by compromising application credentials used for backup operations. The attackers authenticated directly as the backup application using stolen secrets, bypassing protections like multi-factor authentication since no user login was required. ConnectWise has shut down customer access to the service while investigating the breach, though the company states it has found no evide...
What Happened
Between October 15 and 17, 2026, hackers exploited ConnectWise's Cloud Backup service by stealing application credentials (service principal secrets) that the backup software uses to access Microsoft 365 customer data. The attackers authenticated directly as the backup application itself from IP address 144.172.64.128, compromising at least 162 Microsoft 365 tenants without needing to log in as users. ConnectWise has suspended customer access to the Cloud Backup service while investigating, though the company states it has found no evidence that backup archive data itself was compromised.
Who Is Affected
Managed service providers and IT teams using ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) to protect Microsoft 365 data are affected, along with their clients whose tenant environments were potentially accessed. At least 162 confirmed tenants were compromised, with attackers gaining permissions such as Exchange Administrator roles that allow access to emails and other Microsoft 365 resources. The full scope of affected organizations remains under investigation.
Why It Matters
This incident demonstrates how supply-chain attacks targeting third-party backup and management tools can bypass standard security protections like multi-factor authentication by exploiting application-level credentials rather than user accounts. The breach highlights vulnerabilities in how cloud services grant broad permissions to backup applications through service principals, creating attractive targets for attackers seeking access to multiple organizations simultaneously. The scale of the compromise - affecting numerous MSPs and their downstream clients - shows the cascading risk inherent in tools that aggregate access to sensitive data across many tenants.
What You Should Do
If you use ConnectWise Cloud Backup or previously used SkyKick, immediately review your Microsoft 365 audit logs for suspicious activity from October 15 onward, particularly sign-ins from IP address 144.172.64.128 and unexpected role assignments to SkyKick or ConnectWise service principals. Revoke permissions for ConnectWise Cloud Backup application identities in your Microsoft Entra ID admin center and reset any application secrets associated with these services. Review what data may have been accessed during the breach window and consider implementing additional monitoring for unusual email forwarding rules, data exports, or administrative changes in your Microsoft 365 environment.
Summary generated from verified sources and reviewed before publication. How we summarize.