Security researchers have uncovered a major breach involving a shared credential tied to ConnectWise Cloud Backup (formerly SkyKick) that’s been leveraged to access 173 Microsoft 365 tenant environments. The credential, once granted to the backup tool, provided extensive permissions across mailboxes, OneDrive, SharePoint, Teams, and directory data in every affected tenant.
How the Compromise Happened
ConnectWise Cloud Backup, a service used by MSPs (Managed Service Providers) for data protection in Microsoft 365 and Google Workspace, had its credential compromised. Attackers exploited this to generate Microsoft Graph tokens using the existing permissions of the app, gaining unauthorized access in all tenant installations. The intrusion was traced to IP address 144.172.64.128, with confirmed sign-ins recorded between 06:13 and 08:34 UTC on October 15, 2026. The actors systematically moved through tenant GUIDs, suggesting scripted automation.
Scope & Impact
Threat intelligence firm Huntress confirmed that all 173 partner/customer tenants where the app is installed are affected, since the compromised credential is valid everywhere the app has been authorized. Intrusions allowed attackers to read emails, access files in SharePoint and OneDrive, Teams chats, and directory metadata.
More alarmingly, in at least one tenant, a related ConnectWise application escalated its access to Global Administrator, added credentials to other trusted applications—including an MSP management app and the security tool used by the researcher—and created new client secrets. This kind of behavior widens the breach, enabling access not just within single tenants but across an MSP’s full customer base.
What’s Been Done & What Tenants Should Do
ConnectWise has disabled Cloud Backup’s access until its credentials can be rotated, and insists there’s no evidence that backup data itself has been exposed. Meanwhile, security researchers Todyl and Huntress warn that disabling an app only stops new token issuances; active tokens continue to function for up to 90 minutes. That means there’s a critical window where compromised access persists even after mitigation begins.
Tenants should take several steps immediately: disable the app until ConnectWise confirms credential rotation; check Microsoft Graph activity logs; audit for newly added credentials since October 13, 2026; monitor Microsoft Entra (formerly Azure AD) audit logs for any ConnectWise or SkyKick app adding itself to directory roles; and review sign-in logs for the service principal tied to Cloud Backup (application ID 506e08f9-6e9a-4da4-942b-a099a03644ae).
This breach is especially serious given the app’s level of permissions. Because the attackers inherited rights granted to Cloud Backup itself, there’s little visibility—some directories reads leave no audit trail—meaning organizations likely won’t know if or how deeply they were impacted unless they act proactively.
What this means going forward: The incident spotlights the danger posed by vendor or supply-chain credentials with broad permissions across customer environments. MSPs and enterprise teams must heighten controls around vendor access, limit consented app permissions to only what’s essential, and maintain vigilant monitoring of identity activity, especially around privileged roles. Rotating vendor credentials promptly and enforcing zero trust practices are no longer optional—they’re essential.
