Nobody’s password was guessed and nobody clicked a dodgy link. Someone signed in as a trusted backup app. Here’s the story, and a plan, with no daft jargon.
What happened?
ConnectWise Cloud Backup (formerly SkyKick) is a backup and recovery service that managed service providers (MSPs) and IT teams use to protect Microsoft 365 and Google Workspace data (BleepingComputer). To do that job it is granted broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant it is installed in (Huntress). In Microsoft 365, that installed app is an identity called a service principal (BleepingComputer).
On 15 October, the app’s identity signed in to customer tenants from a hosting provider address, 144.172.64.128, and received Microsoft Graph access tokens. Huntress says the sign-ins moved through tenants in sorted order a few seconds apart, “which points to a script working from a target list” (Huntress).
162 tenants: as of 19:00 UTC on 16 October, Huntress had confirmed unauthorised sign-ins in 162 tenants (Huntress). The Hacker News later reported 173, citing Huntress (The Hacker News).
Wider sweep: on 17 October Huntress said almost 1,000 Entra tenants had sign-ins from that address, over 300 of them successful, though tenants without the app weren’t accessible (Huntress).
Microsoft’s view: Microsoft Threat Intelligence called it an “active supply chain attack” (Microsoft). It assessed the attacker likely abused permissions customers had already granted, including Directory.ReadWrite.All, and saw attempts to add extra credentials as a backdoor (The Hacker News).
ConnectWise’s response: it says it found the issue on 14 October. On 17 October it shut off Cloud Backup, disabled seven of its app identities and revoked their certificates. Scheduled backups aren’t running and restores are unavailable; it says archives are encrypted and isolated, with no evidence they were accessed (ConnectWise).
Why MFA didn’t help
Multi-factor authentication (MFA) protects people signing in. Here, no person signed in: the attacker presented the app’s secret and got an app-only token, so “user-focused controls such as MFA and conditional access for users did not apply” (Todyl). Revoking user sessions doesn’t end it, and issued tokens can stay valid for up to 90 minutes after the app is disabled (Todyl).
Admin rights the apps gave themselves
Exchange Administrator: from 15 October, in roughly 50 Huntress-monitored tenants, ConnectWise Cloud Management apps gave themselves directory roles, mostly Exchange Administrator. Huntress says the user agent points to vendor automation, but it hasn’t confirmed that (Huntress). One Reddit user got this alert for a SkyKick app they hadn’t used in years (BleepingComputer).
Global Administrator: in one tenant, the Cloud Management app for Teams made itself Global Administrator, then added new secrets to two other apps (an MSP tool and Huntress’s own), all in about five minutes. Huntress says the threat actor “appears” to have done this (Huntress).
Not everywhere: in the nine tenants Todyl analysed, it found only sign-ins and no changes (Todyl).
What’s confirmed, what isn’t, and what we infer
Confirmed: the Cloud Backup app’s credential was used from outside ConnectWise to sign in to customer tenants and obtain tokens, and ConnectWise has confirmed unauthorised access to its application identities (Huntress) (Todyl) (ConnectWise).
Not known (as of 18 October): how the credential was obtained, or whether a product flaw played a part (both under investigation) (ConnectWise); who is behind it, as nobody has been publicly named and Huntress hasn’t tied the early role changes and later sign-ins to one operator (Huntress); and whether data was taken. Huntress calls it “tokens issued, nothing visible taken”, but directory reads leave no audit trail (Huntress), and Todyl advises treating data as exposed (Todyl).
What we infer (our view, not the investigators’): the weak point wasn’t anything the victims did (Huntress). It was permissions already granted to a trusted app. Any app with tenant-wide access carries that risk if its vendor’s credential leaks, including dormant ones, which ConnectWise asks partners to check (ConnectWise).
It’s the same lesson as the Housing Ombudsman/Workpro supplier incident we covered on 14 October: your suppliers are part of your security (Housing Ombudsman).
Were you affected? How to check
If you, or your IT provider, have ever used SkyKick or ConnectWise Cloud Backup or Cloud Management for Microsoft 365, even years ago, check now; if an MSP set it up, ask them. A clean result doesn’t prove nothing happened (ConnectWise), but start here:
Look for the apps. In the Entra admin centre, open Enterprise applications, clear filters, and search “SkyKick”, “ConnectWise” or app ID 506e08f9-6e9a-4da4-942b-a099a03644ae (Huntress). ConnectWise lists all seven IDs (ConnectWise).
Disable, don’t delete. Under Properties, set “Enabled for users to sign-in?” to No. Deleting removes the consent; disabling pauses backups but email, files and Teams keep working (Huntress).
Save the logs first. Entra ID Free keeps sign-in and audit logs for seven days; P1 and P2 keep 30 (Microsoft). On a Free tenant, 15 October’s activity drops out around 22 October, so export the logs now (ConnectWise).
Check service principal sign-ins. In Sign-in logs, open the Service principal sign-ins tab, filter by the app ID, and look for 144.172.64.128 or any non-Microsoft address (ConnectWise).
Check the audit log and every app’s credentials from 13 October. Look for “Add member to role”, “Add service principal credentials” and “Consent to application” (ConnectWise), secrets or certificates you didn’t create, and any app holding Global or Exchange Administrator (Huntress).
Check mailboxes for new forwarding, inbox or transport rules, or delegated access (ConnectWise).
Don’t switch it back on yet. Keep the apps disabled until ConnectWise confirms all credentials have been reset (Huntress). If you find anything, get incident response help; a reportable personal data breach must go to the ICO within 72 hours (ICO).
Why this matters to you, even if you never used ConnectWise
1. Know every app that’s connected, and remove what you don’t use
List what’s in Enterprise applications (apps from other companies) and App registrations (apps made in your tenant), and give each an owner (Microsoft). Disable, then remove, apps nobody uses. Conditional Access can’t be applied to third-party multi-tenant apps, so least-privilege consent and removing unused apps are the main controls (Todyl).
2. Check what each one can do, and cut it back
Each app’s Permissions page shows what was granted for the whole organisation (Admin consent) and for individual users (User consent), and lets you revoke what isn’t needed (Microsoft). No app should hold an admin role it doesn’t need, and limit who holds Application Administrator and Cloud Application Administrator, as they can add credentials to apps (Huntress).
3. Tighten who can approve new apps
Microsoft recommends allowing user consent only for apps from verified publishers (Microsoft). Switch on the admin consent workflow so staff can request an app and a named reviewer approves it (Microsoft). This doesn’t remove past grants, so do the review too.
4. Watch service principal sign-ins and credentials
Microsoft’s playbook says to check service principal sign-ins for unexpected IP addresses, failures, odd times and frequency, and for unexpected credential changes (Microsoft). With Entra ID P1 or P2 you can also switch on Microsoft Graph activity logs (Microsoft). Send alerts to someone who reads them.
5. Keep a 3-2-1 backup, with a vendor you’ve vetted
Don’t stop backing up Microsoft 365; just don’t rely on one copy. The NCSC describes the 3-2-1 rule as at least 3 copies, on 2 devices, and 1 offsite, with at least one backup offline (NCSC). Right now ConnectWise customers can’t restore at all (ConnectWise). Ask any backup supplier how they protect their app credentials, what permissions they need and how fast they’ll report an incident; the NCSC’s supplier assurance questions help (NCSC).
Your Microsoft 365 app checklist
- Check for SkyKick and ConnectWise apps now, disable (don’t delete) them, and export your logs.
- List every enterprise app and app registration, each with an owner.
- Review permissions and admin roles; revoke anything an app doesn’t need.
- Remove unused apps, and check for credentials nobody can explain.
- Restrict user consent and switch on the admin consent workflow.
- Monitor service principal sign-ins, and keep a 3-2-1 backup with a vendor you’ve vetted.
References
- BleepingComputer, “Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack”, 17 Oct 2026
- Huntress, “ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks”, 16 Oct 2026, updated 17 Oct
- ConnectWise Trust Center, “Cloud Backup (formerly known as SkyKick) Service Interruption”, updated 18 Oct 2026
- Microsoft Threat Intelligence (@MsftSecIntel), post on X, 17 Oct 2026
- The Hacker News, “Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants”
- Todyl, “Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App”
- Housing Ombudsman Service, “Housing Ombudsman Service statement: IT Security Incident”, 13 Oct 2026
- Microsoft Learn, “Microsoft Entra data retention”
- Information Commissioner’s Office, “72 hours – how to respond to a personal data breach”
- Microsoft Learn, “Compromised and malicious applications investigation”
- Microsoft Learn, “Review permissions granted to enterprise applications”
- Microsoft Learn, “Configure how users consent to applications”
- Microsoft Learn, “Configure the admin consent workflow”
- National Cyber Security Centre, “Offline backups in an online world”, blog post
- National Cyber Security Centre, “Supplier assurance questions”
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.