ConnectWise shuts off Cloud Backup after Microsoft 365 tenant break-ins

ConnectWise has switched off its Cloud Backup service, formerly called SkyKick, after attackers got hold of credentials for the app and used them to get into customers' Microsoft 365 tenants. The Hacker News reported on October 18, 2026 that the company disabled seven of its application identities on October 17 at 07:00 UTC and revoked the certificates those connections relied on.

Backup tools need wide access to mail, files, Teams and directory data, so anyone holding the app's credential can request tokens with the same rights without stealing any customer password. Security firm Huntress says it saw sign-in activity from the attacker's IP address in almost 1,000 Entra tenants, about 300 of them successful, and confirmed abuse of a related ConnectWise Teams app in one tenant. Attackers can also plant new secrets on other trusted apps to keep access after the original credential is cancelled.

ConnectWise says it spotted the problem on October 14, that scheduled backups and restores are paused, and that it has no evidence the stored backup archives were touched. It has not yet said how the credential leaked. Partners are told to keep the apps disabled, review sign-ins since October 13, save logs before cleanup, and check app credentials, admin roles, consent grants and mailbox forwarding rules.

Why it matters

Any third-party app you consent into Microsoft 365 or Google Workspace can become a master key, so review app permissions and secrets regularly.

Source: The Hacker News