ConnectWise Cloud Backup Breach: Compromised Credentials Expose 173 Microsoft 365 Tenants
Learn about the ConnectWise Cloud Backup breach, Microsoft 365 tenant risks, compromised application credentials, and recommended security measures.
The ConnectWise Cloud Backup breach highlights the risks of compromised third-party application credentials in cloud environments. According to the reported incident, attackers used a credential associated with ConnectWise Cloud Backup to access Microsoft 365 environments across multiple tenants. The incident reinforces the need to review application permissions, investigate suspicious service principal sign-ins, rotate exposed credentials, and monitor cloud identities for unauthorized changes.
Key takeaways
- A compromised third-party application credential can create security risks across multiple connected Microsoft 365 tenants.
- The article reports 173 affected tenants, but incident counts and assessments have varied across investigations.
- Application permissions can allow a trusted integration to access mailboxes, files, collaboration data, and directory information.
- Review Microsoft Entra service principal sign-ins and audit logs for suspicious authentication and permission changes.
- Keep affected integrations disabled until ConnectWise provides applicable formal restoration instructions.
- Apply least privilege, review application credentials, monitor cloud activity, and investigate possible persistent access.
Introduction
A recent cybersecurity incident has raised concerns about the security of cloud backup services and third-party applications. Attackers reportedly used a compromised credential associated with ConnectWise Cloud Backup, formerly known as SkyKick, to gain unauthorized access to Microsoft 365 environments belonging to 173 partner and customer tenants.
The activity was identified by cybersecurity researchers in October 2026. The incident highlights how a single compromised vendor credential can potentially expose sensitive information across multiple organizations.
For current incident updates and remediation guidance, consult the official ConnectWise Trust Center: www.connectwise.com/company/trust/advisories
How Did the Attack Happen?
ConnectWise Cloud Backup helps managed service providers (MSPs) protect Microsoft 365 and Google Workspace data. To perform backup and recovery operations, the application receives permissions to access resources such as mailboxes, OneDrive, SharePoint, Teams, and directory information.
According to researchers at Huntress, attackers obtained access to a credential associated with the backup application and used it to authenticate against Microsoft services. Because the application already had permissions granted by customers, the attackers could obtain access tokens without needing to compromise each customer's account individually.
Researchers observed suspicious authentication activity on October 15, 2026, originating from the IP address 144.172.64[.]128. Activity across multiple tenants occurred within a short period, suggesting automated operations.
The incident demonstrates how compromising a trusted application can provide access to multiple connected environments. The presence of a suspicious indicator should prompt investigation, but it does not independently confirm that a particular tenant was compromised.
Why Is This Incident Significant?
1. Third-Party Application Risk: Organizations often grant backup services extensive permissions to protect business data. If an application's credentials are compromised, attackers may inherit access associated with those permissions.
2. Potential Exposure of Business Information: Depending on the permissions granted, unauthorized access could involve emails, attachments, files, collaboration data, and directory information. Such access may create risks involving confidential communications, personal information, and business records.
ConnectWise stated that it had not found evidence that Cloud Backup partner backup data was compromised. However, the full impact of unauthorized application access depends on the permissions and activity within each affected environment.
3. Privilege Escalation and Persistent Access: Researchers also reported suspicious activity involving changes to application credentials and directory privileges in at least one tenant. Such modifications can potentially allow attackers to maintain access or extend their reach to other trusted applications.
This reinforces the importance of monitoring not only user accounts but also application identities and their permission changes.
Recommended Security Measures
Organizations using Microsoft 365 should take the following precautions:
1. Review application sign-ins: Examine Microsoft Entra service principal sign-in logs for suspicious activity involving the affected application.
2. Disable affected integrations: Follow ConnectWise's official guidance and keep the application disabled until its security and credential remediation are confirmed. Do not reconnect affected services until formal instructions from ConnectWise apply to your service.
3. Audit application permissions: Identify applications with excessive privileges and remove permissions that are no longer required.
4. Inspect credential changes: Review audit logs for unexpected application secrets, certificates, or directory role assignments.
5. Enable monitoring: Monitor Microsoft Graph activity, unusual access patterns, and suspicious changes to trusted applications.
6. Rotate compromised credentials: Revoke or replace exposed secrets and investigate potentially affected connected services.
Organizations should also investigate the possibility of unauthorized access rather than relying solely on password resets or user-session revocation.
Conclusion
The ConnectWise Cloud Backup incident illustrates the security risks associated with trusted third-party applications and excessive permissions in cloud environments. A single compromised application credential can create consequences across multiple customer organizations.
AESPARROW CONSULTING PVT. LTD. encourages businesses to strengthen cloud identity security, regularly review application permissions, and monitor service principal activity to identify unauthorized access before it develops into a larger incident.
Protect your cloud environment by securing trusted applications, limiting permissions, and monitoring every critical identity.
Official incident updates and partner guidance are available from ConnectWise: www.connectwise.com/company/trust/advisories
Frequently Asked Questions
1. What is the ConnectWise Cloud Backup breach?
The incident involved unauthorized access to application credentials associated with ConnectWise Cloud Backup, formerly known as SkyKick. Those credentials were reportedly used to authenticate against Microsoft services, creating potential risks for connected Microsoft 365 environments.
2. How many Microsoft 365 tenants were reportedly exposed?
The provided article reports that 173 partner and customer tenants were exposed. However, investigations have reported different counts and levels of suspected or successful activity. Organizations should consult current ConnectWise and Huntress updates rather than treating one figure as a final confirmed total.
3. How did attackers use the compromised ConnectWise credential?
According to the article, attackers used a credential associated with the backup application to authenticate against Microsoft services. Because the application already had permissions in customer environments, the compromised integration could potentially provide access without separately compromising every customer's account.
4. What Microsoft 365 resources could be at risk?
Depending on the permissions granted to the application and the activity performed, potentially accessible resources could include mailboxes, email attachments, OneDrive files, SharePoint content, Teams data, and directory information.
5. Does the incident mean that all ConnectWise backup archives were compromised?
No. ConnectWise's published updates stated that existing backup archives remained encrypted and isolated, with no indication that the archives had been compromised. This does not independently establish whether individual Microsoft 365 tenants experienced unauthorized access.
6. What is a service principal in Microsoft Entra ID?
A service principal is the identity of an application in a particular Microsoft Entra tenant. It allows an application to authenticate and access resources according to its assigned permissions. Organizations should monitor service principal sign-ins, credentials, and permission changes.
7. How can organizations investigate suspicious activity related to this incident?
Review Microsoft Entra service principal sign-in logs and audit logs, investigate unusual application authentication and Microsoft Graph activity, and inspect unexpected application secrets, certificates, directory role assignments, and permission changes. Use the official ConnectWise technical investigation guidance for incident-specific checks.
8. Should organizations disable the affected ConnectWise integration?
Organizations should follow ConnectWise's official incident guidance and keep affected application connections disabled until formal instructions and the required security remediation apply to their service. Do not reconnect an affected integration based only on an assumption that the issue has been resolved.
9. Why are excessive application permissions dangerous?
Excessive permissions allow an application to access more resources or perform more actions than it needs. If its credentials are compromised, attackers may be able to misuse those permissions. Applying least privilege and reviewing application consent regularly can reduce this risk.
10. How can businesses reduce third-party cloud application risks?
Businesses should grant only necessary permissions, enable monitoring for application identities, review sign-in and audit logs, investigate unexpected credential changes, rotate compromised secrets, and conduct regular cloud security assessments. They should also follow vendor-specific incident guidance and verify that remediation is effective.
Get expert advice
Put this into practice with Aesparrow
Our cybersecurity experts help you find risks, apply best practices and keep your systems secure — with a free, no-obligation assessment to start.
- Expert guidanceTailored security advice
- Proven experienceReal-world expertise
- Trusted partnerYour security first
Keep reading
All articlesMicrosoft Teams IT Support Scams: Malware Risks
Microsoft Teams IT support scams use impersonation, email bombing, and remote-access tools to deliver malware and potentially ransomware. Learn how attackers exploit external Teams chats, gain access to employee devices, and move through corporate networks, along with practical steps organizations…
Cloud Security: Identity Drift and Misconfigurations
Cloud security risks increasingly stem from identity drift, misconfigurations, excessive permissions, and unmanaged APIs. Learn how the shared responsibility model, machine identity governance, encryption, Infrastructure as Code scanning, and automated remediation help organizations protect…
How Network Security Is Evolving: Zero Trust and AI
Network security is evolving beyond traditional firewalls and VPNs as cloud workloads, remote access, and AI-driven threats reshape the attack surface. Discover how Zero Trust, identity-based access, AI-driven network detection, continuous threat exposure management, post-quantum cryptography, and…
Ready to strengthen your security?
Let’s find the gaps before attackers do
Get in touch with our team and start your security journey today.