ConnectWise suspends Cloud Backup after attackers use it to break into Microsoft 365 tenants
Huntress says it has found at least 162 compromised tenants in its own environment. Microsoft has confirmed malicious activity tied to the backup service.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
ConnectWise has cut off customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers got hold of the service's application identities and used them to compromise Microsoft 365 tenants. BleepingComputer and The Hacker News both reported the suspension. Reports first surfaced on Friday, when administrators saw unauthorized access to client data in Microsoft 365 tenants and pointed to a possible SkyKick/ConnectWise breach. Later that day, the managed security and threat detection company Huntress confirmed the activity and said it had found at least 162 compromised tenants in its environment. Microsoft also confirmed malicious activity involving the service and said it had seen unauthorized authentication attempts from an IP address on October 15. Managed service providers and IT teams use the service to back up and restore email and files in cloud environments such as Microsoft 365 and Google Workspace. For Microsoft 365, it works through permissions granted in Microsoft Entra ID. A "service principal", an application identity inside each customer tenant, lets the software reach data within the limits of those permissions. That design is why the incident counts as a supply-chain compromise: anyone who controls the backup vendor's identities can reach many downstream customer tenants without breaking into each one separately. Organizations served by managed service providers that use the service are the ones affected.