The ConnectWise Cloud Backup breach let attackers sign in to Microsoft 365 tenants as a trusted application. Huntress confirmed unauthorised sign-ins in 162 tenants as of 16 October 2026, and ConnectWise disabled seven application identities on 17 October. Customer backups are paused, with no restart date announced.
What Is Confirmed and What Is Not
What is confirmed is that attackers held a working credential for a trusted application and used it; what is not confirmed is whether they took anything with it. The distinction matters, because the two questions have different answers and most coverage runs them together.
Huntress, the Columbia, Maryland security company that found the activity, traced the sign-ins to a credential issued to ConnectWise Cloud Backup, the Microsoft 365 backup product ConnectWise acquired as SkyKick. The credential lived in the vendor’s own tenant, so the attacker did not need to break into any customer first.
| Point | Status |
|---|---|
| Attackers authenticated as the Cloud Backup application | Confirmed by Huntress and Microsoft |
| 162 tenants with unauthorised sign-ins | Confirmed by Huntress as of 19:00 UTC, 16 October 2026 |
| A second ConnectWise app granted itself Global Administrator | Confirmed by Huntress in at least one tenant |
| Mail, files or Teams messages copied out | Not established; no vendor or researcher has confirmed it |
| Stored backup archives accessed | ConnectWise says it has no indicators of this |
| Who the attacker is | Unattributed as of 19 October 2026 |
ConnectWise said it “recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment”, and added that “We have no indicators to date that Cloud Backup partner backup data has been compromised”, in statements reported by BleepingComputer. Microsoft described the incident as an “active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application”, and assessed that the attacker probably used permissions the application already held, including Directory.ReadWrite.All.
Huntress is blunter about the limits of the evidence. Directory lookups made through Microsoft Graph, the programming interface that applications use to read a tenant’s data, leave no audit trail at all. So an absence of logged file or mail access is not proof that nothing was read.
Who Is Affected
Any organisation whose Microsoft 365 tenant had consented to ConnectWise Cloud Backup is in scope, whether or not it appears in Huntress’s count. Most of those organisations never chose the product themselves — it was installed by the IT provider that manages their email.
That is the shape of a supply-chain attack on managed services: the customer has no relationship with the vendor that was breached. Huntress found sign-in activity from the attacker’s address, 144.172.64[.]128, in almost 1,000 Entra tenants, and more than 300 of those attempts succeeded, according to Huntress’s published advisory. The 162 figure counts tenants where it could confirm the sign-ins were unauthorised.
Seven ConnectWise application identities are implicated. ConnectWise disabled all seven on 17 October, but administrators are being told to disable them in their own tenants as well, because a tenant-side consent survives anything the vendor does at its end.
| Application | Application ID |
|---|---|
| ConnectWise Cloud Backup (formerly SkyKick) | 506e08f9-6e9a-4da4-942b-a099a03644ae |
| ConnectWise Cloud Management | 2399d300-6fca-4e6a-a686-399fefe75b83 |
| Cloud Management – MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 |
| Cloud Management – Exchange Online | b78f6a77-d4e5-46fb-87e5-d1648bd02519 |
| Cloud Management – MS Graph | 0de14c77-b9b0-4137-9360-34878a929827 |
| Cloud Management – Partner Center | 412dcf96-176d-4b3a-a1b0-4981ad66971e |
| Cloud Management – SharePoint Online | b2b55f5b-7758-4719-8d8f-88ae172e6bdb |
In older tenants these may be listed under the SkyKick name rather than ConnectWise. Huntress reports that the second targeted wave on 15 October hit 16 of its protected tenants in the policy, national security, trade and critical minerals sectors — and that most of those tenants do not use ConnectWise products at all, so the attempts failed for want of the application.
Why Microsoft 365 Backups Are Switched Off
Backups stopped because the only way to shut the attacker out was to shut the backup application down, and the backup application is what performs the backups. There is no partial setting.
ConnectWise suspended customer access to Cloud Backup on 17 October and, in an update the following day, said its SaaS Security and Cloud Management products were offline as well, as a precaution. Existing archives are not deleted: ConnectWise says they remain encrypted and isolated, and Huntress’s guidance states that disabling the application pauses automated backups without destroying what has already been stored.
The practical effect is a gap in protection that grows for as long as the suspension lasts. ConnectWise has not given a restoration date. Organisations that rely on Cloud Backup as their only copy of Microsoft 365 mailboxes and SharePoint sites currently have no new restore points being created, which is worth raising with an IT provider before the end of the week rather than after it.
What Administrators Should Do Now
The first step is to disable the Cloud Backup service principal in every tenant, and the order of the remaining steps matters because some of them stop working once consent is removed.
- Disable, do not delete: In Microsoft Entra, open Enterprise applications, find the application, go to Properties and set “Enabled for users to sign-in” to No. Deleting it removes the consent record and forces a fresh consent later to restore service.
- Do not block the application ID: Huntress specifically advises against blocking the ID itself and says to disable the service principal in the tenant instead. The sign-ins arrive through Microsoft’s own infrastructure, so network-level blocking does not reach them.
- Disable the other six applications: Switch off any ConnectWise or SkyKick application you cannot positively verify as safe, until ConnectWise confirms otherwise.
- Check directory roles: Review every ConnectWise or SkyKick application holding Global Administrator or Privileged Authentication Administrator, and remove any role you did not deliberately grant.
- Audit credentials added since 13 October: Inspect client secrets and certificates on all enterprise applications and app registrations — including security and management tooling — and remove anything you did not create. Huntress found a planted credential on its own application in one customer tenant.
- Read the audit logs: Look for applications adding themselves to a role or modifying other applications. Huntress saw the user agent kiota-dotnet on the vendor applications it reviewed, and Python-urllib/3.12 on the credential changes.
- Filter the sign-in logs: Under Monitoring, open Sign-in logs, choose Service principal sign-ins, filter on 506e08f9-6e9a-4da4-942b-a099a03644ae and look for 144.172.64[.]128.
- Review Conditional Access exclusions that name the application, once it is disabled.
Huntress is explicit that a clean log is not a clearance: “A clean result does not rule out access. Please disable the application regardless.”
Why Disabling the App Does Not End the Risk
Disabling an application stops it being issued new tokens, but it does nothing about access the attacker already arranged. This is the part the shorter write-ups skip, and it is the reason this incident will outlast the suspension.
Three mechanisms keep access alive. Tokens already issued stay valid until they expire; ConnectWise said that previously issued access tokens “may remain usable until they expire or are otherwise invalidated”, and the security firm Todyl put that window at up to 90 minutes. Credentials planted inside a tenant are separate objects that survive the application being switched off, and must be deleted by hand. And a role the application granted itself — Huntress recorded the Teams application adding itself to Global Administrator at 03:44 UTC on 15 October, then again at 03:48 — stays assigned until somebody removes it.
In that same tenant, Huntress logged a Python script making nine changes to two other applications, adding client secrets set to expire in 2028. Six of the nine succeeded. Revoking user sessions does not touch any of this, because none of it depends on a user.
The pattern echoes other recent enterprise incidents where applying the vendor’s fix was not sufficient on its own, such as the NetScaler SAML flaw that crashed appliances administrators had already patched. Microsoft’s own research has put the median time from a flaw being found in the wild to being weaponised at well under 24 hours, which is roughly the margin tenants had here between the first scripted sign-ins and the token sweep.
Where the Investigation Stands as of 19 October 2026
As of 19 October 2026, the Cloud Backup service is suspended, ConnectWise has disabled seven application identities and revoked the certificates behind the affected connections, and no restoration date has been published. ConnectWise has said the affected shared Cloud Backup credentials are no longer valid.
No threat actor has been named. Huntress has not tied the 03:44 credential changes to the same operator as the sign-ins from 144.172.64[.]128, because it has no source address for those changes, and it says it has received unverified external reports of similar activity elsewhere. ConnectWise has not said how the credential was stolen in the first place.
Huntress’s instruction on restoring service is unambiguous: “Do not re-enable affected ConnectWise applications until ConnectWise confirms all credentials have been reset.”
Frequently Asked Questions
Was My Email or Files Stolen in the ConnectWise Cloud Backup Breach?
Nobody has confirmed that data was taken. Microsoft and Huntress confirmed the attacker could authenticate with permissions that allow reading mail, files and Teams messages, and the security firm Todyl said that in nine intrusions it analysed it found only sign-in activity. Because Microsoft Graph directory reads are not logged, an empty audit trail is not proof of nothing being read.
Which Application Should I Disable in Microsoft Entra?
Disable ConnectWise Cloud Backup, application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, and then the six ConnectWise Cloud Management applications listed in this article. Set “Enabled for users to sign-in” to No rather than deleting them, so the consent record survives.
Did Multi-Factor Authentication Stop This Attack?
No. The attacker signed in as an application rather than as a person, and multi-factor authentication only applies to user sign-ins. Conditional Access policies written for users did not apply either.
Are My Existing Cloud Backup Archives Safe?
ConnectWise says it has no indicators that partner backup data was compromised, and that archives remain encrypted and isolated. They are not deleted by the suspension, but no new backups are being taken while the service is off.
When Will ConnectWise Cloud Backup Come Back Online?
ConnectWise has not announced a restoration date as of 19 October 2026. Huntress advises administrators not to re-enable the applications until ConnectWise confirms that all credentials have been reset.
