ConnectWise cuts Cloud Backup access after intrusion in its environment

On 17 October 2026, ConnectWise said in a security advisory that it had cut application access for its partners and customers to Cloud Backup, formerly SkyKick Cloud Backup. The company says it detected unauthorized access to application identities in its backup environment. The service lets managed service providers (MSPs) and IT teams protect and restore email and files hosted in Microsoft 365 and Google Workspace. Bleeping Computer reports the incident, citing communications from ConnectWise, Microsoft, Huntress and Todyl.

Existing permissions used without a human signing in

To back up Microsoft 365, Cloud Backup relies on permissions granted through Microsoft Entra ID. Each application is represented there by a service principal, a software identity that holds the rights the customer has granted it. According to Todyl, a cybersecurity platform aimed in particular at MSPs, the attacker authenticated directly with the secret of the backup application. The sign-ins were made by an automated script. No user was signing in, so multi-factor authentication could not come into play.

These rights, already granted in each tenant, made it technically possible to read and write emails and their attachments, OneDrive and SharePoint files, and Teams conversations. If you administer a Microsoft 365 tenant, it is worth checking which applications hold such rights and when you last reviewed them.

Compromises that go beyond the backup

Microsoft says it observed unauthorized authentication attempts from an IP address as early as 15 October. It classifies the incident as an active supply-chain attack. Its analysis estimates that the attacker most likely exploited existing permissions, including Directory.ReadWrite.All.

Huntress, which presents its platform as managed cybersecurity and detection, has identified at least 162 compromised tenants in its environment. Across nearly fifty tenants it monitors, it found that service principals of ConnectWise’s cloud management applications had assigned themselves directory roles, mainly Exchange Administrator. In one tenant, persistence was established in about five minutes. The application “Cloud Management - MS Teams” assigned itself the Global Administrator role and added credentials to an MSP management tool and to Huntress’s own application.

Microsoft describes a backdoor enabled after the service principal authenticated, followed by reconnaissance through the Microsoft Graph API and attempts to add further credentials. Todyl, for its part, analyzed nine tenants where it saw only sign-in activity. It found no trace of account creation, permission changes or password changes, and no persistence through the backup application. The findings therefore vary between tenants and between observers.

What remains uncertain

ConnectWise says it currently has no indication that its partners’ backup data has been compromised. The company states that the existing archive is not affected by the interruption and will be accessible once services are restored. Its investigation and remediation work is ongoing.

On 15 October, a Reddit user reported receiving an alert from Privileged Identity Management. It stated that a SkyKick application had assigned itself the Exchange Administrator role, although the user had not used that application for years. This is a single account, not a verified finding.

These details rest on a single press article that reports the statements of the actors cited. We have not cross-checked them against primary advisories.

The backup service is at the center of this story, but the most worrying point lies elsewhere. Permissions granted years ago, and no longer monitored by the tenant, were enough to read a company’s messages and files.