ConnectWise temporarily shut down parts of its cloud backup and management platform after detecting unauthorized access, leaving managed service providers and their customers unable to back up or restore some Microsoft 365 and other data. ConnectWise said the incident involved unauthorized access to application identities in Cloud Backup, formerly SkyKick, and suspended integrated SaaS Security and Cloud Management services. Huntress said a compromised Microsoft 365 API secret was used to access customer tenants and that a ConnectWise app granted itself Global Administrator privileges and added new credentials to other Microsoft 365 applications.
Why it matters: This can expose downstream customer Microsoft 365 environments through a trusted MSP tool, so the risk is not limited to ConnectWise itself. MSPs and affected customers should urgently review Microsoft 365 enterprise app credentials and privileges, hunt for newly added app secrets, and follow ConnectWise containment guidance before services return.
2026.10.19
98% relevant
This article is a direct update on the same ConnectWise incident, adding details that a compromised Cloud Backup credential and app permissions were used to access customer Microsoft 365 environments, that Huntress saw unauthorized sign-ins in 162 tenants, and that ConnectWise revoked affected certificates and suspended related services.
Ionut Arghire
2026.10.19
99% relevant
This source directly updates the same incident with added detail on timing, service suspensions, the abused Cloud Backup identity, observed access to 162 Microsoft 365 tenants, Huntress telemetry showing sign-ins across nearly 1,000 Entra tenants with 300+ successes, and suspected abuse of Cloud Management apps for Exchange Online, Teams, and SharePoint.
2026.10.19
100% relevant
This article appears to be the first concrete reporting in the set on the October 2026 ConnectWise Cloud Backup-related intrusion and service shutdown affecting MSP-facing SaaS products.
← Back to all stories