ConnectWise Cloud Backup Breach: 173 M365 Tenants and the Vendor Identity Problem
A stolen application credential tied to ConnectWise Cloud Backup let an attacker sign into 173 Microsoft 365 tenants, and no password reset or MFA policy on the customer side could have stopped it.
ConnectWise Cloud Backup, the service formerly branded SkyKick, suffered a vendor credential compromise disclosed in mid-October 2026 that let an attacker sign into at least 173 Microsoft 365 tenants using a stolen application credential rather than a stolen password. ConnectWise disabled the Cloud Backup service on 18 October 2026 while it investigates.
Key takeaways
- A stolen application, or service principal, credential, not a phished user password, gave an attacker direct API access into 173 Microsoft 365 tenants connected through ConnectWise Cloud Backup.
- ConnectWise disabled Cloud Backup entirely on 18 October 2026 rather than patch around the exposure, leaving downstream MSPs without active backups until the service returns.
- Tenant counts differ between reports, 162 versus 173, a reminder that early vendor numbers in a live incident are provisional and should not be treated as a ceiling.
- Resetting user passwords and enforcing MFA does nothing to revoke a compromised OAuth app credential, so MSPs need to audit service principal activity, new client secrets, and Global Admin grants directly in each tenant.
Threat notes, once a week
What our SOC actually saw this week: new attack patterns, the detections we shipped against them, and what it means if you run an MSP. Written by the analysts, not by marketing.
See what 24/7 looks like when the SOC actually acts.
Book a 20-minute platform walkthrough: no slide deck, just the console.
Book a walkthrough →
