ConnectWise Cloud Backup Breach: Check Your Microsoft 365

In short: Between 13 and 15 October 2026, attackers used a stolen credential of the ConnectWise Cloud Backup app (formerly SkyKick) to get access tokens inside customers' Microsoft 365 tenants. ConnectWise has shut off the app. If your company or IT provider uses it, disable it in Entra ID and check for new app credentials.

Most companies never think about the backup tool that their IT partner connected to Microsoft 365. It runs quietly, it has wide access to mail, OneDrive, SharePoint and Teams, and nobody reviews it. This week showed why that quiet trust is a risk, and what to do about it.

What Happened

According to an analysis by security firm Huntress published on 16 October 2026, a credential belonging to the ConnectWise Cloud Backup Microsoft 365 application was compromised. The attacker used it to obtain Microsoft Graph tokens in customer tenants from a hosting-provider IP address on 15 October 2026.

Huntress said it had confirmed unauthorised sign-ins in 162 tenants as of 16 October, and saw sign-in activity from the attacker's address in about 1,000 tenants. The Hacker News, reporting on 17 October, gave a figure of 173 tenants. The numbers differ by source and date, and the story is still developing, so treat them as early counts.

Huntress also reported that in one partner tenant, a second ConnectWise app gave itself Global Administrator rights and added new secrets to two other applications, which could let an attacker come back later. ConnectWise confirmed it had identified unauthorised access to application identities and switched off Cloud Backup application access, according to iTnews. ConnectWise said it had found no evidence that stored backup data was accessed. How the credential was stolen has not been explained, and no attacker has been named.

Who Is Affected

• Organisations that use ConnectWise Cloud Backup, or the older SkyKick backup, for Microsoft 365.
• Companies whose managed service provider (MSP) or IT AMC partner set up this tool on their tenant, even if the company itself never bought it directly.
• Tenants with other ConnectWise or SkyKick Cloud Management apps, which Huntress also advised reviewing.

If you are not sure whether your tenant has these apps, that alone is a reason to check today.

What It Means for Indian Businesses and Departments

Many Indian SMEs and offices run Microsoft 365 through a reseller or IT partner, who often connects third-party tools for backup and management. Each of these apps is granted permissions once, during setup, and then rarely looked at again. This incident shows that a vendor's credential can open the door to every tenant where its app is approved, without any user's password being stolen.

Two practical points follow. First, while the app is disabled, automated backups through it are paused, so you may have a gap in recovery points. Our guide on Microsoft 365 backup for business explains how to plan a second copy. Second, if you find signs of unauthorised access, check whether the event needs to be reported to CERT-In under its 2022 directions, which set a six-hour reporting window for certain incidents. Our CERT-In incident reporting checklist covers the basics. This is not legal advice, so confirm your obligations with your adviser.

What to Do Now

These steps are based on the guidance Huntress published. Ask your IT partner to confirm each one in writing.

1. Find the apps. In the Microsoft Entra admin center, open Enterprise applications and search for ConnectWise Cloud Backup, SkyKick and ConnectWise Cloud Management.
2. Disable, do not delete. Set "Enabled for users to sign-in" to No for these apps. Huntress notes that deleting removes consent and makes restoring the service harder.
3. Check app credentials. Review client secrets and certificates on all enterprise applications and app registrations, especially management and security tools, for anything added since 13 October 2026 that your team did not create.
4. Review admin roles. Remove any directory role, such as Global Administrator or Exchange Administrator, held by a ConnectWise or SkyKick app that you did not deliberately grant.
5. Search the logs. Look at service principal sign-ins and Entra audit logs for 15 and 16 October 2026, including activity from the IP address listed in the Huntress report.
6. Plan for the backup gap. Ask your provider how long the service will be off, confirm existing backups and restore options, and consider a temporary second backup.
7. Keep the apps off until ConnectWise confirms all credentials have been reset, and watch the ConnectWise advisories page for updates.

Huntress also warns that a clean log check does not prove nothing happened, because some reads leave no trace. That is why disabling the apps is advised even when logs look normal.

Frequently Asked Questions

Was my backup data stolen?

ConnectWise has said it found no evidence that stored backup data was accessed. However, the attacker obtained tokens with the app's permissions inside customer tenants, so review your own tenant activity rather than relying only on that statement.

We do not use ConnectWise. Should we still do anything?

Yes. Use this as a prompt to list every third-party app connected to your Microsoft 365 tenant, remove the ones you no longer use, and check which ones hold admin roles or broad permissions.

Will disabling the app break anything?

It pauses backups that run through that app. Existing backups are not deleted, according to ConnectWise, but you should confirm restore options and cover the gap with another backup method if needed.

How Affix Center Can Help

Affix Center, a Mumbai-based IT company, can review the third-party apps and permissions in your Microsoft 365 tenant, check logs, and set up a backup plan that does not depend on a single vendor. See our cybersecurity services and cloud services. Need a quick tenant check? Contact Affix Center.