Your Backup Vendor's Key Got Stolen: What the ConnectWise Cloud Backup Incident Means for Microsoft 365 Offices

If your business runs on Microsoft 365 — especially a law firm, accounting firm or other professional office — ask your IT provider one question this week: do we use ConnectWise Cloud Backup (formerly SkyKick), SaaS Security or Cloud Management? ConnectWise has suspended those three services after a stolen application credential was used to sign in to customers' Microsoft 365 tenants. Backups, archive access and restores are unavailable, and there is no restore date. The full advisory is on the ConnectWise Trust Center.

What ConnectWise has confirmed

The issue: Unauthorized access reached application identities tied to Cloud Backup (formerly SkyKick). ConnectWise first published an advisory on October 16, 2026, and last updated it on October 19 at 13:45 UTC (9:45 AM ET). It says it discovered the problem on October 14.
What's suspended: Cloud Backup on October 17; SaaS Security and Cloud Management on October 18, out of an abundance of caution because they are integrated with Cloud Backup. Backups, archive access, restores, SaaS Security monitoring and Cloud Management user/license tools remain down.
Containment: On October 17 at 07:00 UTC, ConnectWise disabled seven application identities and revoked certificates. It says it has not observed successful threat activity in the environments it monitors since October 17, 05:00 UTC.
Archives: Existing backup archives remain encrypted and isolated, ConnectWise says, with no indication they were accessed — but archive access and restores are still unavailable.
What disabling does not fix: Disabling the connections stops new authentication through them; it does not reverse changes already made inside a tenant. Previously issued tokens may remain usable until they expire.
Actor and restore date: ConnectWise says it cannot discuss threat-actor attribution. As of the October 19 update, it still has no confirmed restoration time.

What Huntress reported

Security firm Huntress reported that a ConnectWise Cloud Backup API credential was used to obtain Microsoft Graph tokens from IP 144.172.64.128 on October 15 between 06:13 and 08:34 UTC. As of about 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. By October 17 it reported sign-in activity from that IP in nearly 1,000 Entra tenants, with over 300 successful. The same IP password-sprayed four law-firm tenants on October 13–14. In one partner tenant, Huntress said the ConnectWise Cloud Management for Teams app assigned itself Global Administrator and added client secrets to other apps. Huntress has not confirmed data theft. ConnectWise later added IPs 144.172.64.99 and .60 for log review.

What isn't known

No public source has named a threat actor. ConnectWise has not confirmed customer data theft from the backup archives, and Huntress has not confirmed data theft from the live tenants it reviewed in detail. Treat any claim of ransomware, mass data theft or a restore date as unconfirmed until a primary source says so.

The takeaway

This is a supply-chain problem: the credential lived in the vendor's tenant, not in yours. If your MSP uses these tools, your Microsoft 365 tenant may still need a hands-on review even after the vendor apps are disabled. Turning them off stops new sign-ins. It does not undo admin roles, app secrets, consents or mailbox rules already left behind.

What to do this week

Ask your IT provider today whether you use ConnectWise Cloud Backup (SkyKick), SaaS Security or Cloud Management — including older "SkyKick Cloud Manager" names.
Keep the affected apps disabled until ConnectWise publishes formal restoration instructions. Match on application ID, not display name. Do not delete the apps as a first step.
Review Entra sign-in logs from at least October 13 for IPs 144.172.64.128, .99 and .60, and for the listed ConnectWise application IDs on the service-principal sign-ins tab.
Audit admin roles, enterprise apps and credentials for unexpected privileged roles, new client secrets or certificates, and unfamiliar consent grants.
Check mail forwarding and inbox rules for external forwarding, hidden rules, and new Full Access or Send As permissions.
Plan for the backup gap. Confirm your last good recovery point and the stopgap your provider will use until service returns. Confirm MFA and Conditional Access still match your policy.

Follow ConnectWise's technical guide on the Trust Center advisories page.

How Brotherly Technology can help

Brotherly Technology helps small businesses, law firms and accounting offices in Rome, Northwest Georgia and beyond review Microsoft 365 tenants after vendor incidents — sign-in logs, admin roles, connected apps and backup continuity. If you want a second set of eyes on your checklist this week, give us a call.