2026 ConnectWise Cloud Backup — app identities abused against M365 tenants

Data compromised

No company census of personal records. Huntress: unauthorized sign-ins in 162 tenants by 16 Oct 19:00 UTC (later reporting ~173). In at least one tenant a second ConnectWise Teams app added itself to Global Administrator and planted app secrets. ConnectWise: no indicator stored backup archives were hit; it cannot see whether a given customer’s live M365 was abused. recordsAffected 0 (tenants, not a people census).

Technical writeup

Root cause

Unauthorized access to application identities in ConnectWise Cloud Backup (formerly SkyKick). Huntress: Cloud Backup app ID 506e08f9-6e9a-4da4-942b-a099a03644ae signed in from 144.172.64.128 (not Azure private space) and obtained Graph tokens. Microsoft called it an active supply-chain attack. ConnectWise cut app access and revoked certificates 17 Oct.

References

• https://www.connectwise.com/company/trust/advisories
• https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
• https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/