Short answer
Attackers used a compromised credential for ConnectWise Cloud Backup, formerly SkyKick, to sign in to customers' Microsoft 365 tenants, according to Huntress and reporting by Help Net Security. ConnectWise suspended Cloud Backup and two related services, and says it has no evidence that stored backups were accessed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | ConnectWise |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Under investigation |
| Sector | Software and managed IT services |
| Country | United States |
| Detected | 2026-10-15 |
| Disclosed | 2026-10-17 |
| People or records affected | At least 162 Microsoft 365 tenants confirmed accessed, per security firm Huntress. ConnectWise has not published its own count. |
What data was exposed
- Not confirmed. ConnectWise says it has no evidence that Cloud Backup partner backup data was compromised.
- Huntress says the app can reach OneDrive, SharePoint, Teams and directory data, and found no email or file access in the one account it examined in detail
What happened
ConnectWise sells software to managed service providers, the outside IT firms many small businesses use to run Microsoft 365. Its Cloud Backup product, formerly SkyKick, is a multitenant app that customers authorize to work inside their tenants. Cybersecurity Dive reported on October 19, 2026 that ConnectWise suspended access to Cloud Backup after a suspected supply chain attack, and also suspended SaaS Security and Cloud Management because they connect to it.
Microsoft Threat Intelligence said it was tracking an active supply-chain attack involving a compromised trusted OAuth app for Cloud Backup. Microsoft assessed that the attacker “likely abused permissions previously granted by customers.”
Timeline
Help Net Security gives this sequence, drawing on ConnectWise and Huntress:
- October 13 and 14: password-guessing attempts against four law firms failed.
- October 15: ConnectWise discovered the problem. The stolen credential was used to sign in as the backup app.
- October 17: ConnectWise disabled seven application identities, revoked their certificates and invalidated shared Cloud Backup credentials.
Cybersecurity Dive says the attack was first detected on a Wednesday, which would be October 14, so the exact start date differs between reports.
Scope and what is unclear
Huntress confirmed access in at least 162 tenants. ConnectWise has not confirmed its own count. Help Net Security reports that in roughly 50 monitored organizations, Cloud Management apps granted themselves administrator roles, and ConnectWise has not said whether that was its own automation. On the root cause, the company said whether a product vulnerability contributed “has not been established.”
What this means for ordinary users
If you do not run an IT system, you may still be affected through your employer or a small firm’s provider. Compromised business mailboxes make convincing phishing, and invoice-redirect fraud is a common outcome. Our guides on phishing messages and urgent-payment scams explain the pattern, and what to do after a data breach covers personal steps. See our editorial policy for sourcing rules.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing sent from a compromised mailbox inside a trusted company, which can pass as a normal message from a colleague or supplier
- Fake 'security update' emails posing as ConnectWise, Microsoft or your IT provider that ask you to approve an app or reset a password
- Business email compromise, where forwarded mail is used to redirect invoices to new bank accounts
What to do if you are affected
- 01If you run Microsoft 365 through a managed IT provider, ask the provider whether it uses ConnectWise Cloud Backup, SaaS Security or Cloud Management, and whether your tenant was checked.
- 02Review sign-in and audit logs, application credentials and federation trusts, as ConnectWise advises, and remove any credentials or roles you did not add.
- 03Check mailboxes for unauthorized forwarding rules, inbox rules and delegated access.
- 04Confirm any request to change payment details by phoning a known number, not replying to the email.
- 05Be wary of unsolicited emails about this incident and go to ConnectWise's advisory page directly.
Frequently asked questions
What happened in the ConnectWise Cloud Backup attack?
According to Huntress, as reported by Help Net Security and Cybersecurity Dive, attackers used a compromised credential for the Cloud Backup app to gain unauthorized access to customers' Microsoft 365 tenants.
How many organizations were affected?
Huntress confirmed unauthorized sign-ins in at least 162 tenants. It also reported sign-in attempts against nearly 1,000 accounts, with over 300 successful, from a separate address, and said it has not confirmed the same operator was behind that activity.
Was backup data stolen?
ConnectWise says its backups remain encrypted and isolated, with no evidence they were accessed. Huntress notes Microsoft does not log some application data reads, so data impact is unclear.
Is Cloud Backup working?
As of October 19, ConnectWise had suspended Cloud Backup, SaaS Security and Cloud Management, with no restoration time given.
What should I do if my IT provider uses ConnectWise?
Ask whether your tenant was reviewed. ConnectWise says disabling the apps does not undo changes already made, so each organization must find and remove any attacker-created credentials, roles or access.
Sources
- ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access, Help Net Security, 2026-10-19
- ConnectWise suspends Cloud Backup after suspected supply chain attack on Microsoft 365, Cybersecurity Dive, 2026-10-19
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.