ConnectWise Cloud Backup (formerly SkyKick): stolen credential opened Microsoft 365 tenants — what to check now

If your company uses Microsoft 365 and an IT provider (an MSP) backs up your email, OneDrive, SharePoint and Teams, take five minutes today to check one thing: whether ConnectWise Cloud Backup, formerly SkyKick, is installed in your environment. Between October 13 and 16, 2026, credentials for that service's applications were used by outsiders to get into customers' Microsoft 365 environments, with no user password or MFA needed.

ConnectWise has suspended the service, disabled seven application identities and says stored backup archives remain isolated with no sign of access. But the company itself warns that disabling the connections does not undo anything that may already have been changed inside each environment. Here is what is known, who should worry and what to check.

What happened

MSPs use Cloud Backup to back up and restore customer data in Microsoft 365 and Google Workspace. To run unattended, the service connects through an application registered in Microsoft Entra ID (formerly Azure AD), approved once by an administrator with broad permissions: reading and writing mailboxes, files and chats.

According to Huntress, a security company that serves MSPs, that application's credential ended up in the wrong hands. On October 15, between 06:13 and 08:34 UTC (15:13 to 17:34 Japan time), the application signed in to customer environments from a hosting-provider address rather than the Microsoft network that legitimate traffic normally comes from. The pattern — tenant after tenant, a few seconds apart — points to a script working through a target list. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants.

Huntress also reports that:

• in roughly 50 tenants it monitors, ConnectWise Cloud Management apps (Exchange Online, Teams and Graph) assigned themselves directory roles, mostly Exchange Administrator;
• in one tenant, the Cloud Management app for Teams made itself Global Administrator and, within about five minutes, added new secrets to two other applications (an MSP management tool and Huntress's own app), creating a way back in valid until 2028;
• on October 13 and 14, the same address tried password spraying against four law-firm tenants, with no confirmed success.

Microsoft confirmed malicious activity involving the service and, according to BleepingComputer, described it as an active supply-chain attack. Todyl, which analyzed nine tenants, found only sign-ins, with no account creation or persistence — showing the impact varies from customer to customer.

What ConnectWise has done

According to the official Trust Center advisory (published October 16, updated October 18 at 01:00 UTC):

• at 07:00 UTC on October 17, it disabled seven application identities (listed below) and revoked the certificates used for those connections; the shared Cloud Backup credentials are no longer valid;
• Cloud Backup is suspended: scheduled backups are not running and restores are unavailable for now;
• SaaS Security and Cloud Management have also been taken offline as a precaution;
• existing backup archives remain encrypted, isolated and preserved, and the company says it has no evidence they were accessed;
• an outside forensics firm has been engaged, and there is no restoration date yet.

Two important caveats from ConnectWise itself: previously issued access tokens may stay valid until they expire, and any credentials, permissions or access created through other identities must be reviewed and removed by the customer. ConnectWise cannot see what happened inside each environment — that check is yours (or your MSP's).

It is still unknown how the credential was obtained, how many organizations were affected in total, or whether data was stolen at scale.

Why this matters for SMBs in Japan

Many small companies in Japan outsource IT and don't even know which backup tool their provider installed. That is exactly the weak spot in this kind of attack: a single vendor with broad access to hundreds of customers becomes a shortcut to all of them. Because the sign-in is done by the application, not a user, employees' MFA offers no protection — and bulk reads of email look normal for a backup service.

We saw the same "the problem was at the supplier" pattern in the Big Echo case. There is also an immediate practical effect: if your Microsoft 365 backup was SkyKick, you have no backup today. Review the 3-2-1 rule and consider a temporary copy through another route until the service returns.

Applications disabled by ConnectWise

Search Entra by Application ID, not by name — older installations may show up as "SkyKick".

The indicator published by ConnectWise and Huntress is the address 144.172.64[.]128 (written with brackets so it doesn't become a link). ConnectWise notes that finding this address, or tools such as Python and curl, in your logs requires investigation but does not by itself prove a compromise.

What to check now

• Ask your MSP whether it uses ConnectWise Cloud Backup, SkyKick or Cloud Management in your environments — including old connections nobody uses anymore.
• In Microsoft Entra, under Enterprise applications, look up the IDs in the table. If any is still enabled, disable sign-in for the app (don't delete it: keep the configuration as evidence).
• Export now the audit and sign-in logs (including service-principal sign-ins). On the free tier, Entra keeps only about 7 days; on P1/P2, about 30.
• Review sign-ins from October 13 (from October 1 if possible), filtering by the application IDs and the address above.
• Check secrets and certificates on every application, not just the seven: secrets added since October 13 with no known owner are the main sign of persistence.
• See who holds privileged roles (Global Administrator, Exchange Administrator, Application Administrator) and whether there are new apps or recent consents nobody approved.
• Look for suspicious forwarding and inbox rules, plus changes to Conditional Access.
• Don't re-enable the applications until ConnectWise publishes reconnection instructions.
• Plan an alternative backup while the service is down.

If you are not sure how to run these checks, our guide to setting up Microsoft 365 for small businesses shows where these options live — and it's a good moment to review your password and two-factor authentication policy.

What is still unknown

ConnectWise is still in the investigation phase and says it will update the Trust Center even when nothing material changes. Three answers are missing: how the credential leaked, how many organizations were affected and what data was actually copied. Huntress says it has seen no new malicious activity since October 15, but reminds admins that secrets planted earlier keep working until they are removed. We will keep following the story and update this article if there are important developments.

Sources

• ConnectWise Trust Center: Cloud Backup (formerly SkyKick) Service Interruption — advisory
• ConnectWise: Product and Services Status
• Huntress: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
• Todyl: Investigation — unauthorized access through the ConnectWise Cloud Backup Microsoft 365 app
• BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
• The Hacker News: ConnectWise suspends Cloud Backup after Microsoft 365 tenant compromise
• Coalition: ConnectWise Investigating Unauthorized Access to Cloud Backup App
• Microsoft Learn: Disable user sign-in for an application in Microsoft Entra ID
• Microsoft Learn: Incident response playbook — compromised and malicious applications

---

Want this for your business?

KGA IT helps small and medium-sized businesses set up AI assistants, automation and websites. The consultation is free and we reply within 24 hours. Plans start at ¥5,000/month.

• Phone: 080-9732-1062
• Email: kga-it@outlook.com
• Contact page: kga-it.com/en/contact