572/69 Tuesday, October 20, 2026
ConnectWise, a provider of IT management and cybersecurity solutions, announced the suspension of its Cloud Backup service, formerly known as SkyKick, along with the temporary shutdown of its SaaS Security and Cloud Management services. The action followed the discovery that attackers had gained unauthorized access to seven application identities and used associated credentials in attempts to access customers’ Microsoft 365 environments. The company detected the activity through internal monitoring on October 14, 2026, disabled the affected identities on October 17, and revoked the certificates used by the applications to prevent further access. ConnectWise stated that it is still investigating how the attackers obtained the credentials and has found no indication that its other products or services were affected.
The attack did not involve direct theft of customer passwords. Instead, the attackers used ConnectWise application credentials that already had authorized access to customers’ Microsoft 365 tenants. This allowed them to impersonate trusted applications and request access tokens from Microsoft Entra ID to reach services and data permitted by those applications, such as Exchange Online, SharePoint, Teams, and directory data. Huntress reported suspicious login activity from IP address 144.172.64.128 associated with approximately 1,000 Microsoft Entra tenants, with about 300 successful logins observed. However, a successful login does not necessarily mean the attackers accessed data within every affected tenant. Huntress also identified targeted attempts against 16 organizations in the policy, national security, trade, and critical minerals sectors on October 15, although all of those attempts were unsuccessful.
ConnectWise said it has engaged its Security Operations Center (SOC) and external incident response specialists to investigate and contain the incident. The company has found no evidence that backup archives were accessed or compromised, and existing backups remain encrypted and stored separately. However, while Cloud Backup remains suspended, scheduled backups cannot run and restoration from affected archives is unavailable. Huntress warned that revoking stolen credentials may not fully eliminate the risk if attackers had already created new applications, added client secrets, or modified permissions within customer tenants. Organizations using ConnectWise Cloud Backup or Cloud Management should therefore review their own Microsoft 365 tenants and those of managed customers, preserve sign-in and audit logs before remediation, and investigate activity associated with the identified IP address from October 13 onward. They should also review application credentials, directory roles, consent grants, Conditional Access policies, and mailbox forwarding rules for unauthorized changes.