ConnectWise shuts down Cloud Backup after attackers hijack its Microsoft 365 app identity

On 17 October 2026, ConnectWise — the Tampa, Florida software vendor whose tools are widely used by managed service providers (MSPs) — shut off customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after confirming that attackers had hijacked the application's identity inside Microsoft 365 and used it to sign in to customer tenants. Because the intruder authenticated as the application itself, rather than as a user, multi-factor authentication and Conditional Access policies did not apply, and the activity bypassed the usual login protections.

Incident responder Huntress, which first raised the alarm, reported that a compromised Microsoft 365 API credential tied to the Cloud Backup application was used to request Microsoft Graph tokens against customer environments beginning on or around 14 October, with sign-ins observed from a hosting-provider IP address that Microsoft confirmed on 15 October. As of 17 October, at least 173 Microsoft 365 partner and customer tenants had confirmed unauthorized sign-ins — up from 162 the day before — and Huntress warned that the stolen credential works against every tenant where the app had been granted consent, so the true exposure could be larger.

Containment

ConnectWise said it disabled seven application identities, revoked the certificates used for the affected application connections, invalidated shared Cloud Backup credentials, and then took Cloud Backup offline for partners and customers while it investigated. A related Cloud Management for Microsoft Teams application was also flagged in the response. The company said it had no evidence that partner backup archives had been accessed and that the existing backup data was not affected, but it could not rule out other unauthorized activity inside live tenants.

A supply-chain exposure

The incident is a textbook third-party supply-chain exposure: a single trusted integration, consented into hundreds of downstream Microsoft 365 tenants, became a skeleton key once its credential was compromised. As of ConnectWise's disclosure, no threat actor had been publicly identified and the company had not explained how the credential was stolen. Huntress advised administrators to check the Microsoft Entra admin center for the Cloud Backup application (ID 506e08f9-6e9a-4da4-942b-a099a03644ae) or "SkyKick" under enterprise applications, and to review sign-in logs for anomalous app-only authentication.