19 OCT 2026 — Someone signed in to customers' Microsoft 365 tenants as ConnectWise's own backup software, using the access those customers had granted it. ConnectWise, which sells the Cloud Backup service it acquired with SkyKick to managed service providers (MSPs), says it found the problem on 15 October. It has suspended the service, and at its latest update on 18 October backups and restores were still unavailable, with no date for their return.
No user password was needed. The intruder authenticated as the application itself, so multi-factor authentication and user sign-in rules never came into play.
What ConnectWise has said
The company first posted its security advisory at 17:47 UTC on 16 October, describing "recent attempts of unauthorized access" and listing one suspicious IP address, 144.172.64.128. By the next morning it had gone further, writing that it had "identified unauthorized access to application identities within the ConnectWise Cloud Backup environment" and was shutting off the application's access to customer tenants.
At 07:00 UTC on 17 October it disabled seven application identities: the Cloud Backup app and six Cloud Management apps, including those for Teams, Exchange Online, SharePoint Online and Partner Center. It also revoked the certificates behind the affected connections, so the shared Cloud Backup credentials no longer work. Tokens issued earlier, it warns, may stay usable until they expire. SaaS Security and Cloud Management, which are built on Cloud Backup, are offline too.
The update posted at 18:45 UTC on 18 October added two more addresses in the same block, 144.172.64.99 and 144.172.64.60, which it says were passed on by security teams watching partner and customer tenants.
What the researchers found
Huntress, a security firm that works with MSPs, published its analysis on 16 October and has updated it since. It says the backup app's identity signed in from 144.172.64.128, a hosting-provider address, between 06:13 and 08:34 UTC on 15 October and obtained Microsoft Graph tokens. The tenants were hit a few seconds apart in sorted ID order, which Huntress reads as a script working through a list. By 19:00 UTC on 16 October it had confirmed unauthorised sign-ins in 162 tenants.
Huntress's later numbers are broader. It says almost 1,000 Entra tenants show sign-in activity from that address, and more than 300 of them successful, though tenants without the ConnectWise app installed were not opened. It also describes a smaller, failed wave on 15 October against 16 of its tenants in the policy, national security, trade and critical-minerals sectors, most of which do not use ConnectWise at all.
The more serious finding was earlier that morning. In roughly 50 tenants Huntress monitors, service principals for ConnectWise's Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. Huntress notes the user agent matched ConnectWise's own automation and says it has not confirmed with ConnectWise whether that activity was legitimate. In one tenant, though, the Teams management app made itself Global Administrator and a Python script then added new client secrets to two other applications, one of them Huntress's own. Huntress removed the secret on its app on 16 October.
Todyl, another MSP security vendor, reached a narrower result in its own running investigation, also dated 16 October. In the tenants it watches, the backup app signed in once per tenant between 07:11 and 08:47 UTC on 15 October, and Todyl saw the backup app create no new secrets, consents or role assignments there. It still tells customers to treat their data as exposed, because Microsoft's logs cannot reliably show what an application read.
Why one credential reached so far
A multi-tenant app such as Cloud Backup proves who it is with a credential held by the publisher, and that one credential is valid in every tenant that has consented to the app. A backup service needs broad rights to copy and restore mail, OneDrive and SharePoint files and Teams data. Whoever holds its credential inherits those rights, with no user in the loop.
Microsoft has also confirmed malicious activity involving the service, according to a BleepingComputer report on 17 October, which says Microsoft Threat Intelligence called it an active supply-chain attack. RECATOOLS has not read Microsoft's post directly.
What administrators should do now
ConnectWise, Huntress and Todyl all describe the same first steps. In Entra, find each of the seven application IDs ConnectWise lists, match on the ID rather than the display name (older tenants may show "SkyKick Cloud Manager"), and set sign-in to disabled. Disable rather than delete, so the configuration and evidence survive. Keep the apps off until ConnectWise says how to reconnect.
Then export the audit and sign-in logs before they age out. ConnectWise points out that Entra keeps them for seven days on the free tier and 30 days on P1 and P2. Check service principal sign-ins, which do not appear on the default user tab, against the three published addresses from 13 October onwards. Review every app's secrets and certificates for anything added since 13 October, remove directory roles nobody granted, and look for new consent grants, Conditional Access changes and mailbox forwarding or transport rules.
Huntress adds the point most likely to be missed. Turning off the ConnectWise apps does not remove credentials an attacker may already have added to other applications.
What is still unknown
ConnectWise has not said how the credential was exposed, or whether a product flaw played a part; its advisory says both remain under investigation. It says it "cannot discuss threat actor attribution", and no official source has named one. It reports no sign that the encrypted backup archives were accessed, but stresses that this says nothing about customers' live Microsoft 365 environments, which it cannot see.
Nobody has yet shown what data, if any, was taken. Huntress found no mail or file access in the one tenant it examined closely, and both firms warn that reads through Microsoft Graph often leave no audit trail. ConnectWise says it has not confirmed any downstream customer compromise. That is not an assurance that none occurred.
View author profile → · Editorial policy
