ConnectWise Cloud Backup breach exposes 173 Microsoft 365 tenants

According to The Hacker News, attackers used a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to obtain Microsoft Graph tokens and sign in to customers' tenants. Any tenant that had the backup app installed and consented to its permissions was affected.

How the ConnectWise Cloud Backup breach worked

ConnectWise Cloud Backup is a third-party backup and recovery service used by managed service providers to back up mailboxes, OneDrive, SharePoint, Teams, and directory data. The service requires broad permissions to do that work. The Hacker News reports the compromised app credential was used much like the legitimate service, inheriting the app's existing consent and permissions in each tenant.

Huntress told The Hacker News it observed confirmed unauthorized sign-ins in 173 partner and customer tenants. The actor obtained Microsoft Graph tokens from the IP address 144.172.64[.]128 and moved through tenants in sorted GUID order, a pattern Huntress says looks like a scripted run against a target list. As Huntress put it, "The app's credential is in hostile hands," according to the article.

Todyl and Microsoft gave similar findings: Todyl detected an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application, while Microsoft described an active supply chain attack targeting the backup application's trusted OAuth app. The Microsoft advisory included the application ID (506e08f9-6e9a-4da4-942b-a099a03644ae) that security teams can use to search service principal sign-ins.

What researchers observed and why the access matters

The attackers used the compromised application identity to obtain tokens that inherit the app's permissions. Those permissions can include the ability to read and write mail and attachments, access OneDrive and SharePoint files, read Teams chats, and perform directory reads or writes depending on the consent granted in each tenant. Huntress warned that some directory reads through Microsoft Graph leave no audit trail, increasing the risk that unauthorized access could go unnoticed.

In at least one partner tenant, The Hacker News says a separate ConnectWise app (ConnectWise Cloud Management, application ID 24205314-2b89-4e07-a2a4-579e898a5640) assigned itself Global Administrator privileges and then added client secrets to other trusted applications inside the tenant. That behavior can extend access beyond a single tenant because MSP management apps are often consented into customers' tenants. Adding a credential to a security tool's application gives the holder whatever that tool is allowed to do, the reporting notes.

ConnectWise told customers it has closed Cloud Backup application access while it investigates and remediates, and the company said it has found no evidence that Cloud Backup partner backup data was compromised, according to The Hacker News.

Practical steps for small businesses, nonprofits, and public sector IT teams

Follow these steps now if your tenant has the ConnectWise Cloud Backup app installed:

• Disable the ConnectWise Cloud Backup application in your tenant until ConnectWise confirms credentials have been rotated. The Hacker News reports disabling the app stops new tokens from being issued, though tokens already issued can remain valid for up to 90 minutes.
• Review service principal sign-ins in the Microsoft Entra Admin Center, using the Service principal sign-ins tab and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, as ConnectWise advised.
• In sign-in logs, look at the IP address column for authentications from addresses outside expected Microsoft/Azure ranges. The Hacker News highlights 144.172.64[.]128 as a suspicious address associated with this activity.
• Enable or review Microsoft Graph activity logs and Entra audit logs for OAuth grant activity, app credential changes, and any app adding itself to directory roles. Audit for any new credentials created since October 13, 2026, per the reporting.
• Audit privileged roles and credentials for third-party apps, especially MSP management tools and security tools, and look for unexpected client secrets added to trusted applications.

Want to know how exposed your own site is? Start with a free external scan.

What to watch next and related supply chain activity

Microsoft, Huntress, and independent researchers are continuing to investigate. The Hacker News links this incident with other supply chain attacks described by Google, Mandiant, and third parties, noting a separate campaign against AOMEI Backupper that used short, five to ten minute tampering windows to deliver malware called CROSSROAD and SHINYROAD, attributed to a cluster named UNC7017. That report shows threat actors can use both long-lived compromises and brief, targeted tampering of update infrastructure to reach victims.

Because the ConnectWise incident abuses a vendor credential rather than a single user account, the exposure is as broad as the app's footprint. The full potential impact will vary by tenant depending on the permissions that were consented.

What your decision-makers should know

This is a vendor-supplied credential compromise that can give attackers access to multiple customer tenants. It reinforces two points every organization should treat as routine: track which third-party apps have high privileges in your tenant, and log the relevant service principal and Microsoft Graph activity so you can spot unusual service principal sign-ins or app credential changes quickly. Follow the audit and disabling steps published by ConnectWise and Microsoft while vendors complete credential rotation and remediation.

This is a developing story. The Hacker News and other firms cited in the reporting are updating their findings as investigations continue.