A security incident at ConnectWise — one of the biggest software vendors in the managed-IT industry — let attackers quietly sign into hundreds of small-business Microsoft 365 accounts over the past week using a stolen vendor credential. If your company uses an MSP that backs up Microsoft 365 mailboxes, SharePoint or Teams, this one hits close to home: the attackers didn't need your password or your MFA code to get in.
What happened
On October 17, 2026, ConnectWise shut off customer access to its Cloud Backup service, formerly known as SkyKick Backup, after confirming that hackers had hijacked the application's own identity inside Microsoft 365 and used it to sign in to customer tenants without ever touching a password or multi-factor prompt.
ConnectWise Cloud Backup (Formerly SkyKick) is a cloud-based backup and recovery service built for managed service providers (MSPs) to protect their clients' Microsoft 365 or Google Workspace data. That means the compromised tool sits inside a huge number of small-business M365 tenants with broad, trusted access — exactly the kind of access an attacker wants.
Operating from IP address 144.172.64.128 between 06:13 and 08:34 UTC, attackers scripted through tenants in sorted GUID order, harvesting Microsoft Graph tokens and inheriting the application's broad permissions—full mailbox access, OneDrive, SharePoint, Teams, and directory data.
How bad is it
The blast radius keeps growing. As of 19 October, Huntress has discovered almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity (144.172.64[.]128). Over 300 of these succeeded.
ConnectWise took action on October 17, 2026, at 07:00 UTC, and has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users. Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant.
Translate that out of IT-speak: shutting the door now doesn't undo anything the attacker already did inside your mailboxes, SharePoint sites, or Entra directory. And scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable.
Why this matters for small businesses
This is a textbook supply-chain attack: the attacker never had to breach your business directly. They breached a tool your IT provider trusts. The tech giant said the threat actor likely abused permissions previously granted by customers to the application, including highly privileged permissions like Directory.ReadWrite.All. With that level of access, an attacker can read email, pull files, and quietly add their own backdoor credentials to maintain access later.
Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor. That's the piece that should worry owners most — even after ConnectWise revoked the stolen credential, a backdoor planted during the attack window could still be live in your tenant.
What your IT provider should be doing right now
If you work with an MSP — or you're thinking about who covers your managed IT and cybersecurity — these are fair questions to put in writing this week:
1. Do you use ConnectWise Cloud Backup (SkyKick) in our Microsoft 365 tenant? If yes, when was it last audited? 2. Have you reviewed our Entra ID service principals for new credentials or secrets added since October 13, 2026? 3. Have you checked sign-in logs for the IP 144.172.64.128 and other unrecognized service principal sign-ins? 4. Are our Microsoft 365 backups still running, and if not, what's the interim plan?
The critical remediation step is to review all application credentials, secrets, and certificates for unauthorized additions since October 13, 2026, remove any unauthorized entries, and revoke unnecessary application consents, especially for dormant or unused SkyKick or ConnectWise Cloud Backup integrations. If your provider can't answer those questions clearly, that itself is a finding.
For businesses with an in-house IT person who's suddenly swamped by this, a co-managed IT arrangement can bring in extra hands for exactly this kind of incident-response triage without ripping out what you already have.
What York Businesses Should Do
York County small businesses on Microsoft 365 should ask their IT provider in writing this week whether ConnectWise Cloud Backup (SkyKick) is installed in their tenant and whether the Entra ID audit for new app credentials since October 13 has been completed. If you don't have a provider to ask, York Computer can run that review for you.
Sources
- Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants — The Hacker News
- ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants — The Hacker News
- ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks — Huntress
- ConnectWise breach: Cloud services disruption continues three days after initial intrusion detected — ITPro
- ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access — Help Net Security