ConnectWise has temporarily suspended its Cloud Backup service, along with two related services, after attackers used a compromised application credential to sign into customers’ Microsoft 365 accounts. The incident, which the company disclosed on October 15 and is investigating with outside help, gives managed service providers a clear set of checks to run in every Microsoft 365 tenant they administer.
What happened
According to Help Net Security, an unknown attacker used a compromised credential belonging to the ConnectWise Cloud Backup application, the product ConnectWise acquired with SkyKick in 2024, to sign into Microsoft 365 tenants where the app had been authorized. ConnectWise disabled seven of its application identities on October 17, revoked the certificates behind them, and invalidated the shared Cloud Backup credential, but the company warns that access tokens issued before that shutdown may remain valid until they expire, and that disabling its apps does not undo changes already made inside a customer account.
Are you affected?
You are affected if your organization uses ConnectWise Cloud Backup, ConnectWise SaaS Security, or ConnectWise Cloud Management, or if your IT provider (an MSP) uses those tools to manage your Microsoft 365 environment. The Cloud Backup app, formerly SkyKick, is the entry point. Once authorized in a tenant, it acts as a service principal that can read and write email, OneDrive, SharePoint and Teams data without anyone signing in.
According to Huntress, the stolen credential was used on October 15 between 06:13 and 08:34 UTC to sign in as the backup app from 144.172.64[.]128, an address tied to a hosting provider rather than the Microsoft cloud the app normally uses. Huntress confirmed unauthorized access in at least 162 Microsoft 365 tenants and saw sign-in attempts against nearly 1,000 accounts, with more than 300 successful sign-ins. The same address also targeted 16 organizations in policy, national security, trade and critical minerals sectors, most of which do not use ConnectWise products.
How to check: in Microsoft Entra ID, look at enterprise applications for any of the affected ConnectWise apps and review service principal sign-in logs (not the default user sign-in view) for activity from 144.172.64[.]128 around October 15. Audit logs should be checked for new credentials, new administrator roles, and mailbox changes since October 13. Huntress observed the ConnectWise Cloud Management app for Microsoft Teams granting itself global administrator rights in at least one tenant and adding new credentials to other trusted applications, with those credentials set to remain valid until 2028. ConnectWise has not said whether a product vulnerability contributed to the credential exposure.
What to do now
- Ask your MSP, or whoever runs your Microsoft 365, whether ConnectWise Cloud Backup, SaaS Security, or Cloud Management is in use and whether the tenant appears in the affected set.
- Disable the affected ConnectWise applications in Entra ID rather than deleting them, so investigators can still review their activity. Disabling alone does not remove credentials or roles an attacker may have added.
- Review every application in the tenant for credentials created since October 13, paying close attention to credentials with expiry dates in 2028 or later.
- Search service principal sign-in logs (not the default user view) for activity from 144.172.64[.]128 and for sign-ins from the ConnectWise apps from unfamiliar locations.
- Follow ConnectWise’s published technical investigation and remediation guide, which walks through app status, sign-in and audit records, credentials, permissions, administrator roles, and hidden ways back in, including changed mailbox settings.
Background on the service and the risk
ConnectWise sells most of its products to managed service providers, the outside IT firms that small and mid-sized companies hire to run their technology. The company says more than 100,000 MSPs use its platform, and each may look after dozens or hundreds of client organizations. Cloud Backup keeps copies of email, OneDrive and SharePoint files, and Teams chats so they can be restored after accidental deletion or a ransomware attack. To do that, an administrator at each client grants the software broad permissions through Microsoft Entra ID, Microsoft’s identity system. The backup app then exists in that organization as an application identity and can read and write data without any person signing in.
Microsoft has described the incident as a supply chain attack because a single compromise at the vendor reached customers of many different MSPs at once. Huntress observed that in one tenant, the ConnectWise Cloud Management app for Microsoft Teams made itself a global administrator and, within about five minutes, added new credentials to two other trusted applications, an MSP management application and Huntress’s own security platform. Those credentials were set to remain valid until 2028, giving whoever created them a way back in that would survive the shutdown of ConnectWise’s apps.
Service status and data exposure
As of October 19, the Cloud Backup, SaaS Security and Cloud Management services remain suspended. No scheduled backups are running, and customers cannot restore data. ConnectWise says it cannot yet pinpoint a restoration time. The company also says its stored backups remain encrypted and isolated and that there is no evidence they have been accessed. In the one account Huntress examined in detail, it found no sign of email or file access, but it cautioned that Microsoft does not record some kinds of data reads by applications, so absence of a log does not prove nothing was taken.
Open questions
ConnectWise has not established whether a product vulnerability contributed to the incident, and the original credential-exposure mechanism remains under investigation. It is also unclear what the attackers took, if anything, from the tenants they reached, since Microsoft does not log every type of application data read. The company has asked partners who sell the service through resellers, distributors or marketplaces to make sure the remediation guide reaches whoever actually administers each customer account.
FAQ
What is ConnectWise Cloud Backup?
ConnectWise Cloud Backup, formerly SkyKick, is a backup service that copies Microsoft 365 email, OneDrive, SharePoint files, and Teams chats so they can be restored after accidental deletion or a ransomware attack. ConnectWise acquired it with SkyKick in 2024.
Which ConnectWise services are suspended?
As of October 19, ConnectWise Cloud Backup, SaaS Security, and Cloud Management are all suspended because they are integrated with Cloud Backup. No scheduled backups are running, and customers cannot restore data. ConnectWise has not given a restoration time.
How can my IT provider check if my Microsoft 365 account was touched?
Your MSP should disable the affected ConnectWise applications rather than delete them, review every application in your tenant for credentials created since October 13, and search service principal sign-in logs for activity from 144.172.64[.]128 around October 15. ConnectWise has published a technical investigation and remediation guide that walks through these checks in detail.