The ConnectWise Microsoft 365 breach has revealed a serious risk: a trusted backup service can become the entry point for attackers. Most businesses think of their backup service as the safety net, the one system that’s there for you when everything else goes wrong. This week, for a lot of organizations, the safety net was the way in.
ConnectWise has shut down its Cloud Backup service (formerly SkyKick Cloud Backup) after attackers used a credential belonging to the service to sign in to customers’ Microsoft 365 environments. Security firm Huntress says it confirmed unauthorized sign-ins across 162 tenants as of October 16. Nobody’s password was stolen. Nobody clicked a phishing link. And multi-factor authentication never had a chance to help. The ConnectWise Microsoft 365 breach is a clear example of how application-level access can bypass traditional controls.
What Happened in the ConnectWise Microsoft 365 Breach
To back up email, files, and Teams chats, a cloud backup service needs broad permissions inside each customer’s Microsoft 365 tenant. Those permissions aren’t given to a person. They’re given to an application identity, which Microsoft Entra ID calls a “service principal.”
According to Huntress, a Microsoft 365 credential (an API secret) belonging to ConnectWise Cloud Backup was compromised. The attacker used it to authenticate as the backup application itself and pull Microsoft Graph access tokens in customer tenants. On October 15, the app signed in from 144.172.64[.]128, a hosting-provider address instead of the Azure network it normally uses.
Microsoft confirmed the malicious activity and described it as an active supply-chain attack. ConnectWise disabled seven application identities on October 17 and took Cloud Backup, SaaS Security, and Cloud Management offline. In its October 19 update, the company added two more attacker IP addresses and said it still had no timeline for restoring service. The ConnectWise Microsoft 365 breach demonstrates how quickly a single vendor credential can be weaponized across many environments.
Why MFA Didn’t Stop It
When an application signs in on its own, no user password is involved and no MFA prompt is triggered. And because the stolen credential lived in ConnectWise’s environment, Huntress notes that nothing a customer did inside their own tenant could have produced it or prevented it.
The access that credential carried was significant. Researchers at Todyl said it gave the attacker “the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats.” In one partner tenant, Huntress watched a second ConnectWise app, Cloud Management for Microsoft Teams, grant itself Global Administrator and add new credentials to two other applications, including Huntress’s own. The whole sequence took about five minutes.
So far, Huntress says it hasn’t confirmed data theft. In the one tenant it examined in detail, it found no recorded mail or file access. It also warned that some Microsoft Graph directory reads don’t leave an audit trail, so “nothing visible taken” is not the same as “nothing taken.” This uncertainty is one of the most concerning aspects of the ConnectWise Microsoft 365 breach.
It’s Part of a Bigger Pattern
If this sounds familiar, it should. In 2025, stolen OAuth tokens from the Salesloft Drift integration were used to get into Salesforce data at hundreds of companies, including Palo Alto Networks. Different vendor, same lesson: every third-party app you connect to your core systems is another key to the front door, and attackers have figured out that stealing one vendor’s key can open many doors at once.
It’s also a credential-hygiene story. Like the long-forgotten exposed AWS keys we wrote about in August, application secrets tend to be created once and then left alone for years. One administrator posted on Reddit that Microsoft’s Privileged Identity Management alerted them on October 15 that the SkyKick service principal had made itself an Exchange Administrator, in a tenant that hadn’t used the app in years. The ConnectWise Microsoft 365 breach reinforces why long-lived and under-monitored application permissions remain a persistent threat.
Why This Matters for Your Organization
You don’t have to be a ConnectWise customer to be affected. ConnectWise Cloud Backup was built for managed service providers, so if an IT provider ever set up Microsoft 365 backups for you, this app may be sitting in your tenant without you knowing it. Even organizations not directly impacted by the ConnectWise Microsoft 365 breach should treat this as a prompt to review all third-party application access.
Shutting down the vendor’s side doesn’t clean up yours. ConnectWise says disabling its apps blocks new sign-ins through those connections, but it doesn’t reverse changes already made inside customer tenants, and previously issued access tokens may keep working until they expire. Todyl adds that revoking user sessions doesn’t end app-based access. Meanwhile, scheduled backups aren’t running and restores aren’t available. ConnectWise says existing archives remain encrypted and isolated, with no indication they’ve been compromised.
What to Do This Week
- Ask your IT provider directly: “Are any ConnectWise or SkyKick apps in our Microsoft 365 tenant?” In older tenants, they may show up as “SkyKick Cloud Manager.”
- If they’re there, disable (don’t delete) ConnectWise Cloud Backup and ConnectWise Cloud Management – MS Teams in Entra, as Huntress recommends. Keep them disabled until ConnectWise issues formal restoration instructions.
- Review service principal sign-ins in Entra for the Cloud Backup application, and look for any source address outside Microsoft’s network, including 144.172.64[.]128, 144.172.64[.]99, and 144.172.64[.]60.
- Check the secrets and certificates on every enterprise application and app registration for anything added since October 13 that you didn’t create, and remove it.
- Review directory role assignments, consent grants, policy changes, and mailbox forwarding rules for anything unexpected.
- Confirm you have another way to recover critical Microsoft 365 data while Cloud Backup is offline.
- Inventory every third-party app with access to your tenant and remove the ones nobody uses anymore. These actions help contain the residual risk created by the ConnectWise Microsoft 365 breach.
The Takeaway
Your security is only as strong as the vendors you’ve handed keys to. This attack didn’t beat anyone’s passwords or MFA. It walked in using permissions customers had granted on purpose, sometimes years ago, and then forgotten about. The ConnectWise Microsoft 365 breach makes one lesson clear: to know exactly which apps can reach your data, give them only the access they need, and watch what they do with it.
Not sure which apps can read your company’s email right now? Black Belt Secure can help you find out and lock down what shouldn’t be there. Schedule a free assessment today.
Source: BleepingComputer (Oct 17, updated Oct 18); CSO Online (Oct 19); Huntress (Oct 16, updated Oct 17)