ConnectWise is responding aggressively to a security incident involving its Cloud Backup service (formerly SkyKick) after unauthorized access was detected in application identities linked to the platform. As of October 17, all affected credentials tied to Cloud Backup have been reset or suspended, and the company has taken major services offline to contain the breach. The investigation remains ongoing.
What’s happened so far
The incident first came to light on October 14–15, 2026, when a compromised application credential for ConnectWise Cloud Backup was used to authenticate as the app itself—rather than as individual users—against Microsoft 365 tenants. A single hosting-provider IP address, 144.172.64.128, was involved in those suspicious sign-ins.
On October 17, ConnectWise disabled seven internal application identities and revoked certificates tied to the affected app connections. Shared credentials used by Cloud Backup were invalidated. In tandem, services integrated with Cloud Backup—specifically SaaS Security and Cloud Management—were suspended proactively, since those systems share dependencies. Scheduled backups, restorations, archive access, and user/license management for those services remain unavailable. ConnectWise says there is no current indication that stored backups were accessed.
Who’s affected and what to watch
ConnectWise MSP partners and customers relying on Cloud Backup are directly affected. Since the application credential worked across all tenants that had consented, the exposure could extend beyond those with confirmed sign-in logs. Huntress, the security firm investigating, confirmed at least 173 Microsoft 365 partner/customer tenants showed unauthorized sign-ins; that number had increased rapidly over October 17.
Services impacted include Cloud Backup, SaaS Security (monitoring & alerting), and Cloud Management (user/license management). These remain suspended during the remediation. While backup archives are maintained, isolated and encrypted, access and restoration is paused until it’s safe to resume. There’s no confirmed evidence yet that customer files, emails, or live tenant configurations were manipulated—but the threat isn’t ruled out.
Indicators & response
Three IP addresses have been flagged as Indicators of Compromise (IOCs): 144.172.64[.]128, 144.172.64[.]99, and 144.172.64[.]60. Observed suspicious User-Agents include Python-urllib/3.12 and python-requests/2.31.
ConnectWise has published a technical guidance document urging partners and customers to review sign-in logs and audit trails across Microsoft Entra (Azure AD), especially for service principal activity, permission changes, and new secrets. Enterprises are advised not to reconnect any affected applications until explicit instructions are issued by ConnectWise.
ConnectWise, along with third-party security and forensics specialists, is continuing to validate the containment efforts. So far, it reports that no new threat activity has been observed in monitored environments since mitigating actions were deployed. Restoration timelines have not yet been confirmed.
What this means:The breach underscores risks inherent in app-based access across many customer environments—especially when a single credential with wide consent is compromised. This isn’t just about restoring service—it’s about rebuilding trust in third-party tools that act with elevated permissions. MSPs and enterprises alike should be reviewing app consent models, tightening service principal oversight, and preparing incident response plans for identity-based supply-chain attacks. What to watch: whether any downstream data exfiltration is confirmed, and how ConnectWise plans to restore access without reintroducing exposed credentials or vulnerabilities.
