Insights Security & Privacy
Backup app used by IT firms was hacked: ask if your Microsoft 365 is affected
The short version
ConnectWise suspended its Cloud Backup service, formerly SkyKick, by 17 October 2026 after attackers misused it to enter customers' Microsoft 365 accounts. If an outside IT firm manages your email, ask whether this app is in your account.
What happened
The attackers signed in as the backup software itself, using access that customers had already granted it. Because no person was logging in, extra login checks such as multi-factor authentication did not stop them. Microsoft said it saw suspicious sign-in attempts on 15 October.
Security firm Huntress said it had found at least 162 affected tenants (company Microsoft 365 accounts) among those it monitors. In some, related ConnectWise apps gave themselves administrator roles. Todyl, another security firm, said that in the nine cases it studied, it saw only sign-ins.
ConnectWise disabled seven of its app connections and says it has no evidence that stored backups were accessed. Scheduled backups are not running, and it has given no date for restoring the service.
Why it matters to you
Switching the app off stops new sign-ins through it, but it does not remove anything an attacker may already have added to an account, such as extra passwords or administrator rights. The app could read and change email, files and Teams chats.
Scheduled backups through this service are not running, so if it is your only backup, you may currently have none of your Microsoft 365 data. The app may also still be in your account if your IT provider stopped using it years ago.
What to do
Ask your IT provider whether ConnectWise Cloud Backup, Cloud Management or SkyKick is connected to your Microsoft 365, and whether they have checked your account since 13 October. Ask them to check for forwarding rules and unfamiliar administrators.
Also ask what they are doing about backups until the service returns.
Sources
- Cloud Backup (formerly known as SkyKick) Service Interruption – ConnectWise Trust Center advisories ConnectWise (primary source) (opens in a new tab)
- Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack BleepingComputer (opens in a new tab)
- Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants The Hacker News (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.