---
title: "Data breach at ConnectWise (Cloud Backup, anciennement SkyKick)"
description: "ConnectWise said it identified unauthorized access to application identities in its Cloud Backup service (formerly SkyKick) and shut down access to the service for its partners and clients. Unauthorized sign-ins to customers' Microsoft 365 environments were observed from October 15, 2026; Huntress c"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-17-connectwise-cloud-backup-anciennement-skykick
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-17
dateModified: 2026-10-17
---
# ConnectWise (Cloud Backup, anciennement SkyKick)

Data breach — Low

ConnectWise said it identified unauthorized access to application identities in its Cloud Backup service (formerly SkyKick) and shut down access to the service for its partners and clients. Unauthorized sign-ins to customers' Microsoft 365 environments were observed from October 15, 2026; Huntress counted at least 162 compromised tenants among its customers, and Microsoft confirmed the malicious activity. The attacker authenticated as the backup application using its credentials, which bypassed multi-factor authentication. ConnectWise states there is no indication so far that partner backup data was compromised; Todyl's analysis of nine tenants found only sign-in activity and no evidence of data access. The permissions already granted to the application did, however, give it the technical ability to read and write mail, files and Teams chats.

The permissions granted to the application would have allowed a third party to read and modify mail, attachments, OneDrive and SharePoint files and Teams chats in affected tenants.

| Fact | Value |
| --- | --- |
| Disclosed on | October 17, 2026 |
| Incident dated | October 15, 2026 |
| Sector | Digital services |
| Country | International or undetermined |
| Cause | Credential stuffing |
| Severity | Low |
| Status | Confirmed |

## Exposed data

- Other personal data

## What you can do

- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/) — Bleeping Computer
- [ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) — Huntress
- [ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant](https://specterops.io/blog/2026/10/17/connectwise-skykick-breach-microsoft-365/) — SpecterOps

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-17-connectwise-cloud-backup-anciennement-skykick
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees