October 18, 2026: A security breach involving ConnectWise Cloud Backup has raised concerns over the safety of Microsoft 365 customer data after attackers used compromised vendor credentials to access multiple customer environments.
Cybersecurity firm Huntress reported 173 confirmed cases of unauthorised sign ins across partner and customer tenants. The activity was detected on October 15, 2026, with attackers using a compromised credential linked to ConnectWise Cloud Backup, previously known as SkyKick Backup.
The service helps managed service providers (MSPs) back up and restore data from Microsoft 365 and Google Workspace. To perform these tasks, it receives extensive permissions to access customer mailboxes, OneDrive, SharePoint, Microsoft Teams and directory information.
The stolen credential gave the attackers access to the same permissions already granted to the application in customer environments, creating a risk that extended across every tenant where the service remained authorised.
Attackers used automated access methods; ConnectWise Breach Exposes 173 Microsoft 365 Tenants
According to Huntress, the attackers obtained Microsoft Graph access tokens from the IP address 144.172.64[.]128 between 06:13 and 08:34 UTC on October 15. The sign ins occurred within seconds of one another, following a sequence based on tenant identifiers. Researchers said this pattern suggested the use of automated tools.
Once authenticated, the attackers could potentially read emails, attachments, files and other information available to the backup application. The extent of access in each organisation depends on the permissions granted to the service.
Huntress also linked the same IP address to password spraying attempts against four law firm tenants on October 13 and 14. The firm said its telemetry showed no successful user sign ins from those attempts.
The investigation uncovered further activity in at least one partner tenant. Researchers found that a separate ConnectWise application associated with Microsoft Teams had added itself to the Global Administrator role. The application then modified two other trusted applications by adding new client secrets.
One of the affected applications was an MSP management tool, while the other belonged to Huntress’s own security platform.
Adding credentials to trusted applications can allow an attacker to maintain access and potentially reach additional systems. The risk is particularly serious for MSPs because their management tools may have permissions across multiple customer environments.
Microsoft and security firms warn of wider exposure
Microsoft confirmed that it was tracking an active supply chain attack involving the ConnectWise Cloud Backup application. The company said the attackers appeared to have abused permissions previously approved by customers, including highly privileged directory access.
Microsoft also observed successful application sign ins from the suspicious IP address, followed by Microsoft Graph reconnaissance and attempts to add credentials to application identities in targeted tenants.
Security firm Todyl independently reported unauthorised authentication to Microsoft Graph through the ConnectWise Cloud Backup application. Its analysis found that the access inherited the application’s existing permissions, including access to mail, attachments, OneDrive, SharePoint and Teams data.
Todyl warned that revoking ordinary user sessions would not necessarily stop the activity because the attackers were authenticating through an application identity rather than a standard user account. Disabling the application can prevent new tokens from being issued in a tenant, but previously issued tokens may remain valid for up to 90 minutes.
ConnectWise suspends application access
ConnectWise has disabled Cloud Backup application access while its investigation and remediation work continues. The company confirmed unauthorised access to application identities within the Cloud Backup environment but said it had found no evidence that partner backup data had been compromised.
The company has advised customers to review Microsoft Entra sign in logs for activity associated with the Cloud Backup application.
Security teams should check service principal sign ins for the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and investigate activity from unfamiliar IP addresses, particularly 144.172.64[.]128. They should also review audit logs for unexpected application credential changes, new directory role assignments and changes to OAuth permissions.
Organisations using the service should consider disabling the affected application until ConnectWise confirms that the compromised credentials have been rotated and access has been secured. Microsoft Graph activity logs and Entra audit records can also help identify suspicious activity that may have followed the initial access.
Huntress has urged organisations not to wait for definitive evidence of data theft before taking action. Some directory access through Microsoft Graph may not leave the same audit records as other operations, making it harder to establish the full scope of the incident.
The incident highlights the risks associated with granting third party backup services broad access to business data. A compromised vendor credential can expose multiple organisations at once, particularly when the affected application is trusted across several customer environments.
