ConnectWise (Cloud Backup, anciennement SkyKick)
LowConfirmedDigital services
ConnectWise said it identified unauthorized access to application identities in its Cloud Backup service (formerly SkyKick) and shut down access to the service for its partners and clients. Unauthorized sign-ins to customers' Microsoft 365 environments were observed from October 15, 2026; Huntress counted at least 162 compromised tenants among its customers, and Microsoft confirmed the malicious activity. The attacker authenticated as the backup application using its credentials, which bypassed multi-factor authentication. ConnectWise states there is no indication so far that partner backup data was compromised; Todyl's analysis of nine tenants found only sign-in activity and no evidence of data access. The permissions already granted to the application did, however, give it the technical ability to read and write mail, files and Teams chats.
The permissions granted to the application would have allowed a third party to read and modify mail, attachments, OneDrive and SharePoint files and Teams chats in affected tenants.
- Disclosed on
- October 17, 2026
- Incident dated
- October 15, 2026
- Sector
- Digital services
- Country
- International or undetermined
- Cause
- Credential stuffing
Exposed data
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact