ConnectWise halts Cloud Backup after its own app credential opened Microsoft 365 tenants

ConnectWise, the Florida-based supplier of software to managed service providers, has kept its Cloud Backup service switched off since early on Saturday, October 17, after attackers used a stolen credential belonging to the application itself to sign in to customers' Microsoft 365 environments. As of Monday, October 19, Cloud Backup, formerly sold as SkyKick, remained suspended together with the related SaaS Security and Cloud Management services. No scheduled backups were running, archives could not be restored, and the company had not given a date for restoration.

The scale is still being measured. Huntress, a security company that protects many of the affected service providers, confirmed unauthorised sign-ins to at least 162 Microsoft 365 tenants and, by October 17, had seen sign-in activity from the attacker's address in nearly 1,000 tenants, more than 300 of them successful. ConnectWise says it has found no evidence that partner backup data was compromised and that the archives remain encrypted and isolated. That reassurance addresses the backups. It does not address the more uncomfortable question the incident raises: what happens when the trusted software an organisation has invited into its systems becomes the intruder.

How a backup app became a master key

Cloud backup tools for Microsoft 365 work by being granted standing permission to read a customer's data. According to Huntress, the ConnectWise application had broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it was installed. Microsoft Threat Intelligence assessed that the attacker likely abused permissions that customers had previously granted to the application.

The sign-ins required no user at all. The attacker authenticated directly as the application, using its secret, so there was no password to phish and no multi-factor prompt to approve. Huntress's early analysis described app-only sign-ins that obtained Microsoft Graph tokens from a single hosting-provider address. Help Net Security, citing Huntress, reported that the attacker signed in as the backup application between 06:13 and 08:34 UTC on October 15, after unsuccessful password guessing against four law firms on October 13 and 14. How the credential was exposed has not been established.

The intrusion did not stop at reading data. In one tenant observed by Huntress, a ConnectWise Cloud Management application for Microsoft Teams granted itself Global Administrator rights and then added credentials to two other trusted applications, an MSP management tool and Huntress's own app, with the new secrets set to remain valid until 2028. Huntress said attackers typically established persistent access within about five minutes. A separate wave the same day targeted 16 organisations in policy, national security, trade and critical minerals; it failed, and most of those organisations did not use ConnectWise products.

Containment has limits

ConnectWise disabled seven application identities on October 17, revoked their certificates and invalidated the shared Cloud Backup credentials. Its own advisory is candid about what that does not achieve. Access tokens issued before the shutdown may stay usable until they expire, and disabling the applications on the vendor's side does not undo changes already made inside customer tenants. The company says it cannot see into those environments, so each service provider must review its own tenants and those of its clients, preserve sign-in and audit logs, and look for unfamiliar credentials, mailbox forwarding and inbox rules dating back to at least October 13.

Responders were also told to disable rather than delete the legitimate ConnectWise apps, because deletion would prevent existing backups from being restored. That detail captures the bind for customers: the application that may have been used against them is also the only route back to their archived data. Huntress has added that a successful sign-in does not by itself prove that data was read or copied, and that some application data access does not appear in Microsoft's logs. Microsoft has characterised the episode as an active supply chain attack.

The economics of the MSP chokepoint

The managed service model is efficient precisely because one provider runs the IT of dozens or hundreds of small and mid-sized businesses through a shared set of tools. That efficiency is also the risk. A vendor serving many service providers sits two steps upstream of thousands of end customers, and a single compromised secret can, as Huntress noted, unlock any installation of the software. The pattern is familiar from the 2021 Kaseya ransomware attack, which reached up to about 1,500 downstream businesses, and from SolarWinds.

It is also not ConnectWise's first serious incident. In May 2025 the company disclosed that a suspected nation-state actor known for intelligence collection had compromised cloud-hosted ScreenConnect instances belonging to a very small number of customers, and brought in Mandiant to investigate.

ConnectWise has been owned by Thoma Bravo, the software-focused private equity firm, since a deal announced in February 2019. Under that ownership it has grown by acquisition, announcing the completed purchase of SkyKick in September 2024 alongside an agreement to buy Axcient, to offer service providers a single stack spanning management, security and data protection. The strategy is common across private equity owned MSP software, where bundling raises revenue per partner and switching costs. This week shows the other side of the bundle: one compromised component forced the vendor to pull adjacent security and management products offline as well, and to concede that it could not tell partners whether their customers had been breached.

Machine identities are the new perimeter

The broader lesson is about non-human identities. Enterprises have spent a decade hardening human sign-ins with MFA and conditional access. Service principals and OAuth applications, by contrast, often hold wider permissions than any employee, authenticate with long-lived secrets, and are rarely reviewed after the consent screen is clicked. Huntress's guidance, to review credentials on every enterprise application, not only ConnectWise's, and to check for unexpected administrator roles and conditional access exclusions, amounts to an admission that few organisations know what their third-party apps can do.

That gap is a market. Identity threat detection, SaaS security posture management and tools that inventory and govern application permissions have attracted investment on the argument that the identity layer is where attacks now land. Incidents in which a vendor's own app does the damage are the clearest evidence for that case, and buyers will be more willing to pay for monitoring that does not depend on the vendor's own assurances.

Our view

This is a costly episode for ConnectWise even if no backup archive was touched. A backup service that cannot back up or restore for days fails at the one moment customers notice it, and service providers who must now audit every client tenant will remember who caused the work. Expect pressure on renewals and pricing at the margin, and harder security questions in procurement across MSP software.

For investors, the incident sharpens a tension in the private equity roll-up model for MSP tools. Consolidation creates a platform, but it also concentrates trust, and a vendor that holds standing access to thousands of tenants is a target worth a patient adversary's time. Buyers of such assets should price in security engineering, not just cross-selling. For founders in identity and SaaS security, the demand signal is clear: governance of application permissions and secrets is moving from a compliance checkbox to an operational necessity.

What to watch: when ConnectWise restores service, whether it explains how the credential leaked, how many tenants show data access rather than sign-ins, and whether Microsoft tightens defaults for high-privilege third-party apps.

Sources

• Help Net Security: ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access
• BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
• Huntress: ConnectWise (SkyKick) vendor credentials abused in M365 attacks
• SecurityWeek: ConnectWise suspends cloud services in response to cyberattack
• GovInfoSecurity: ConnectWise suspends Cloud Backup services as it probes hack
• Channel Dive: ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users
• Thoma Bravo: ConnectWise accelerates next generation of data protection and cybersecurity for MSPs with acquisitions of Axcient and SkyKick
• ITPro: ConnectWise snapped up by private equity firm
• Help Net Security: Attackers breached ConnectWise, compromised customer ScreenConnect instances

Filed under Cybersecurity. Written by Invest Times Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.