ConnectWise Cloud Backup Breach: 173 M365 Tenants and the Vendor Identity Problem
A stolen application credential tied to ConnectWise Cloud Backup let an attacker sign into 173 Microsoft 365 tenants, and no password reset or MFA policy on the customer side could have stopped it.
ConnectWise Cloud Backup, the service formerly branded SkyKick, suffered a vendor credential compromise disclosed in mid-October 2026 that let an attacker sign into at least 173 Microsoft 365 tenants using a stolen application credential rather than a stolen password. ConnectWise disabled the Cloud Backup service on 18 October 2026 while it investigates.
Key takeaways
- A stolen application, or service principal, credential, not a phished user password, gave an attacker direct API access into 173 Microsoft 365 tenants connected through ConnectWise Cloud Backup.
- ConnectWise disabled Cloud Backup entirely on 18 October 2026 rather than patch around the exposure, leaving downstream MSPs without active backups until the service returns.
- Tenant counts differ between reports, 162 versus 173, a reminder that early vendor numbers in a live incident are provisional and should not be treated as a ceiling.
- Resetting user passwords and enforcing MFA does nothing to revoke a compromised OAuth app credential, so MSPs need to audit service principal activity, new client secrets, and Global Admin grants directly in each tenant.
Sources
- ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant
- Stolen ConnectWise 'SkyKick' credential exposed Microsoft 365 tenants - iTnews
- Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
- ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
- ConnectWise Cloud Backup Supply-Chain Attack: Analysis of Microsoft 365 Tenant Compromise and Mitigation Strategies
- ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
- ConnectWise Cloud Backup Breach Hits 173 Tenants [2026]
- ConnectWise SkyKick Credentials Abused in Microsoft 365 Attacks, Backup Services Shut Down
- ConnectWise SkyKick breach: Microsoft 365 tenants hit
- When Your Backup Vendor Becomes the Attack Path: ConnectWise Attack Identification Instructions
- Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 accounts
- Stolen ConnectWise Cloud Backup Credential Used to Sign In to 173 Microsoft 365 Tenants - DEV Community
- ConnectWise app credential: Huntress gives three tenant counts
- ConnectWise Cloud Backup Breach: 173 M365 Tenants Hit
- ConnectWise's Backup App Signed Into 173 Microsoft 365 Tenants With No Password. Then the Backups Stopped.
- ConnectWise Credential Breach Affects 173 Microsoft 365 Tenants - Memesita
- ConnectWise Credential Compromise Hits Microsoft 365 Tenants
- Trust Center
- ConnectWise Product and Services Status
- ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
Threat notes, once a week
What our SOC actually saw this week: new attack patterns, the detections we shipped against them, and what it means if you run an MSP. Written by the analysts, not by marketing.
See what 24/7 looks like when the SOC actually acts.
Book a 20-minute platform walkthrough: no slide deck, just the console.
Book a walkthrough →
