ConnectWise has taken its Cloud Backup service offline after a stolen credential was used to access customer Microsoft 365 environments, iTnews reports. The immediate problem for customers is twofold: their tenants may have been exposed, and they cannot restore data from the offline service.
Watch Desk analysis
What happened
The credential gave access to application identities in ConnectWise Cloud Backup, formerly known as SkyKick. Security firm Huntress told iTnews it confirmed unauthorised sign-ins in 162 Microsoft 365 tenants, then found activity from the attacker’s address in almost 1,000 tenants. Huntress said the credential could work across every tenant where the app had been authorised, so the confirmed count may not capture the full exposure.
ConnectWise said it cancelled the credential and had found no evidence that stored backups were accessed. It also said it cannot see into customers’ tenants or determine whether any individual environment was accessed. The service remains offline, leaving customers unable to restore data through it.
Huntress also said a second ConnectWise app gained global administrator rights in one customer tenant and added credentials to two other apps, one belonging to an MSP management tool and one to Huntress. Those credentials were set to last until 2028; Huntress says it found and removed the one affecting its own app. The report gives no attribution for the activity.
Why it matters
Cloud Backup needs broad access to the Microsoft 365 data it protects. A credential with access across authorised tenants therefore creates a risk beyond the backup service itself: attackers may be able to reach live mailboxes, files and user directories. The number of confirmed sign-ins is not the same as proof that every affected tenant’s data was accessed.
The outage adds a practical complication. ConnectWise says it found no evidence that stored backups were accessed, but customers still cannot restore them while the service is offline. For managed service providers and their clients, checking the Microsoft 365 environment and having another route to recovery are both suddenly rather less theoretical.
Our read
The key distinction is between access, confirmed sign-ins and proven data theft. iTnews reports that Huntress confirmed sign-ins across 162 tenants and found wider activity, while ConnectWise says it has no evidence stored backups were accessed. Neither statement establishes what happened inside every customer tenant.
Administrators should follow Huntress’s advice, as reported by iTnews: disable, rather than delete, the ConnectWise apps in their tenants, and check for app credentials added since 13 October. Deleting apps could remove useful evidence; this is a moment for careful checking, not a hurried bit of digital tidying.
What to watch
- Whether ConnectWise restores Cloud Backup and explains how the credential was stolen.
- Whether Huntress or affected customers identify further unauthorised access or persistence.
- Whether ConnectWise provides customers with clearer guidance on assessing their individual tenants.
Discussion spark: Should MSP customers treat a provider’s broad access to Microsoft 365 as an acceptable trade-off for easier backups, or insist on tighter limits even if recovery becomes more complicated?
Sources and evidence
- Source update (18 October 2026, 00:00 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.