ConnectWise has shut down Cloud Backup — the service formerly known as SkyKick, which managed service providers use to back up Microsoft 365 and Google Workspace mailboxes and files — after discovering that a credential the service uses to connect into customer tenants had been compromised. Security firm Huntress, which first spotted the activity in its own customers' environments, has confirmed unauthorized sign-ins across 173 Microsoft 365 tenants, with ConnectWise's own investigation still ongoing.
The attackers didn't need a password or an MFA code. Cloud Backup authenticates to a customer's Microsoft 365 tenant as a trusted "app-only" identity — the same mechanism that lets the backup service run unattended in the background. Once the attackers had that credential, they could sign in the same way, inheriting whatever broad permissions the customer had already approved for backups: typically read access to mail, OneDrive, SharePoint and Teams data. Huntress traces the first scripted sign-in attempts to 13–14 October, with confirmed unauthorized activity from 15 October. In at least one customer tenant, a second ConnectWise application escalated further, granting itself the Global Administrator role and then running a script that added new credentials, set to expire in 2028, to two other trusted apps — a persistence mechanism built to survive the original compromise being cleaned up.
ConnectWise cut off customer access to Cloud Backup on 17 October and says it has no evidence so far that backed-up data itself was accessed — the compromise is in the credential used to reach into tenants, not, as far as the company can tell, in the backup archives.
What this means for your business
If a managed service provider or your IT team backs up your Microsoft 365 mailboxes using ConnectWise Cloud Backup or SkyKick, ask them this week whether they've checked Microsoft Entra sign-in logs for activity from the IP address 144.172.64.128, and for any new credentials or certificates added to their backup application since 13 October. ConnectWise's own guidance is specific here: simply disabling the app is not enough, because credentials the attacker already added will survive that step — those need to be found and removed directly, and the application shouldn't be re-enabled until ConnectWise confirms the original credential has been rotated.
More broadly, this is a reminder that a backup vendor's standing access into your tenant is worth protecting as carefully as your own logins. A backup service typically holds broad, unattended permission into your mailbox and files precisely so it can run without anyone present — which makes a compromise of the vendor's own credentials just as serious as a compromise of yours. It's a fair question for any vendor with that kind of access: how do they protect the credentials that let them in?