ConnectWise Supply Chain Attack Breaches Microsoft 365 Tenants

Overview of the Breach

A recent supply-chain attack has compromised multiple Microsoft 365 tenants through vulnerabilities in ConnectWise’s Cloud Backup service, previously known as SkyKick Cloud Backup. Concerns first arose on October 15, 2026, when IT administrators uncovered unauthorized access to client data associated with their Microsoft 365 environments. ConnectWise confirmed that after a thorough investigation, they had shut down customer access to the service to prevent further data breaches.

Managed cybersecurity and threat detection platform Huntress reported a minimum of 162 Microsoft 365 tenants were compromised. Additionally, Microsoft corroborated these findings, citing unauthorized authentication attempts traced to an IP address that launched attacks on the same day.

Details of the Malicious Activity

The malicious activity was linked to automated sign-in requests originating from a single IP address, 144.172.64[.]128. This address was active on October 15, and reports suggested attempts to gain unauthorized access to application identities within ConnectWise's Cloud Backup infrastructure.

Users were alarmed when Microsoft Privileged Identity Management (PIM) notifications indicated the assignment of administrative roles tied to the SkyKick service principal, sometimes for applications that hadn’t been utilized for years. In total, three primary application IDs were identified by researchers at various cybersecurity firms, including those from Huntress and Todyl.

Significant Application IDs Used in Attacks

This structured approach by the attackers—leveraging authorized paths into the tenants—has made traditional defenses, including multi-factor authentication (MFA), ineffective.

Impact on Microsoft 365 Services

ConnectWise's backup services are essential for managed service providers (MSPs) and IT teams as they facilitate data protection and restoration in environments like Microsoft 365 and Google Workspace. Following the breach, ConnectWise promptly suspended access to their Cloud Backup service and commenced an investigation, indicating, "We have no indicators to date that Cloud Backup partner backup data has been compromised. The existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored."

The suspension, however, has disrupted scheduled backups, leaving affected parties without restoration capabilities. At this moment, the status and extent of any data theft remains uncertain as investigations continue.

Details of the Cyber Intrusions

While Huntress analyzed intrusions in over 50 tenants, they discovered that service principals for ConnectWise’s Cloud Management applications were granting themselves elevated roles, such as Exchange Administrator with suspicious rapidity. One tenant even experienced five minutes of unauthorized persistence activity where alterations like credential addition to a management tool were recorded.

Todyl noted that the compromised service principal had direct access to Microsoft 365, which allowed for reading and writing capabilities across email, OneDrive, SharePoint files, and Teams communications. Though initial signs show activity primarily aimed at access rather than significant alterations—no accounts were created or passwords changed—the potential for data loss remains alarming.

Recommended Actions for Administrators

Administrators are urged to conduct thorough checks of all service principal sign-ins within the Microsoft Entra platform, specifically looking for unusual activities linked to the Cloud Backup application ID. Additionally, Microsoft has put forth guidelines that emphasize the importance of reviewing application credential changes, OAuth grants, and related activity via the Microsoft Graph.

• Disable affected ConnectWise applications.
• Inspect application credentials for unauthorized additions since October 13, 2026.
• Examine any additional Cloud Management integrations for suspicious activity.

ConnectWise has also compiled a resource referring to older tenants that may still list Cloud Management apps under "SkyKick Cloud Manager" to ensure proper identification.

Future Implications and Timeline

As of October 18, 2026, the Cloud Backup service remains unavailable, along with other connected services such as SaaS Security and Cloud Management, which have been taken offline as a precaution. ConnectWise has not set a definitive timeline for restoring services but reassured customers that existing backup archives are encrypted and presumed safe at this stage.

This incident underscores the critical need for regular security assessments and audits within organizations that utilize third-party cloud services. Programs necessitating constant monitoring of application permissions are vital to pinpoint potential vulnerabilities before they can be exploited by malicious actors.

Key Takeaways

• Unauthorized access to Microsoft 365 tenants was confirmed due to a ConnectWise supply-chain attack, affecting at least 162 tenants.
• The incidents began with malicious activity traced to a specific IP address on October 15, 2026.
• Service principals with elevated permissions played a key role in enabling unauthorized access.
• ConnectWise has halted Cloud Backup services as investigations continue, but existing backup data is believed to remain secure.
• Admins are advised to scrutinize application identities and credentials to mitigate risk.

As cybersecurity continues to be a pressing concern in cloud environments, this event highlights how crucial it is for companies to enhance their security protocols and regularly review their dependencies on third-party services.