Sunday 18 October 2026
Live
ZOTPAPER

News without the noise

ZOTPAPER
Security

ConnectWise disables Cloud Backup service after hackers compromise Microsoft 365 tenants

Attackers used application identities to bypass multi-factor authentication and access customer data

By LineZotpaper
Published
Read Time2 min
ConnectWise has shut down customer access to its Cloud Backup service after hackers exploited application identities to breach Microsoft 365 tenants, giving them the ability to read emails, files, and Teams chats without triggering multi-factor authentication. Security firm Huntress reported at least 162 compromised tenants, and Microsoft confirmed it detected malicious authentication attempts from a single IP address on October 15.

ConnectWise disabled its Cloud Backup service (formerly SkyKick Cloud Backup) over the weekend after reports emerged of unauthorized access to Microsoft 365 customer data. The company said it identified unauthorised access to application identities within the Cloud Backup environment and cut off application access for partners and clients.

Managed security platform Huntress confirmed the breach, stating it found at least 162 compromised tenants in its environment. Microsoft also acknowledged the activity, saying it noticed suspicious authentication attempts from the IP address 144.172.64[.]128 on October 15.

According to researchers from cybersecurity platform Todyl, the attacker authenticated directly to Microsoft 365 as the backup application using its secret. Because the application already held broad permissions granted by customers, the sign-ins gave the attacker the technical ability to read and write mail, attachments, OneDrive and SharePoint files, and Teams chats. Since the authentication did not involve a user login, protections like multi-factor authentication were ineffective.

One Reddit user reported receiving a Microsoft Privileged Identity Management alert on October 15 about the SkyKick service principal assigning itself the Exchange Administrator role, even though they had not used the app in years.

ConnectWise said it has no evidence that backup data was compromised, and that the existing cloud backup archive is not impacted. The company is investigating and working to restore services, but has not provided a timeline.

§

Analysis

Why This Matters

  • The breach highlights a critical supply-chain vulnerability: trusted third-party applications with broad permissions can be hijacked, bypassing standard security controls like MFA.
  • Managed service providers (MSPs) that rely on ConnectWise's backup tool now face potential exposure of client emails, files, and communications across multiple organisations.
  • The incident underscores the risk of application identities (service principals) being abused, a growing vector in identity-based attacks.

Background

ConnectWise's Cloud Backup service is used by MSPs and IT teams to back up customer data from cloud platforms including Microsoft 365 and Google Workspace. For Microsoft 365, the service uses a service principal in Azure Active Directory (Microsoft Entra ID) to access customer tenants. Supply-chain attacks that compromise trusted software vendors have become an increasingly common tactic, as attackers seek to gain access to downstream customers through a single point of entry.

Key Perspectives

ConnectWise: The company has acknowledged unauthorised access to application identities and shut down the service proactively. It states backup data was not compromised and is conducting an investigation. Affected MSPs and customers: They face potential data exposure and have lost access to a critical backup service. Many are now reviewing permissions and assessing if the attacker accessed sensitive data. Security researchers (Huntress, Todyl, Microsoft): They identified the attack technique, confirmed the scope, and warned that the use of service principals to bypass MFA is a significant concern for cloud security.

What to Watch

  • Investigation outcome: whether ConnectWise finds evidence of backup data being accessed or exfiltrated.
  • Service restoration: when ConnectWise re-enables Cloud Backup and what additional security measures are put in place.
  • Broader impact: if other similar application-identity based attacks emerge targeting MSP tools.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe