ConnectWise Cloud Backup breach hits Microsoft 365 tenants
ConnectWise has shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers accessed application identities and compromised Microsoft 365 tenants, according to BleepingComputer. Huntress says it found at least 162 compromised tenants in its own environment. No CVE has been assigned and no patch is involved; the exposure comes from permissions customers had already granted to the backup app.
What we know
- Administrators began reporting unauthorized access to client data in Microsoft 365 tenants on Friday, linking it to a possible SkyKick or ConnectWise breach.
- Huntress confirmed the activity and reported at least 162 compromised tenants in its environment.
- Microsoft also confirmed malicious activity involving ConnectWise Cloud Backup. It said it saw unauthorized authentication attempts from an IP address on October 15.
- ConnectWise said in a security advisory that it recently identified unauthorized access to application identities in the Cloud Backup environment. It shut down application access for partners and clients and has opened an investigation.
- ConnectWise said it has no indicators so far that partner backup data was compromised, and that the existing backup archive is not affected and will be accessible once services are restored.
Reports from Microsoft, Huntress and administrators place the start of the activity at October 15 at the earliest, from a single IP address. One Reddit user reported a Microsoft Privileged Identity Management alert on October 15 showing a SkyKick service principal assigning itself the Exchange Administrator role, even though they had not used the app in years. That is a user report and has not been independently confirmed.
How the attack worked
ConnectWise Cloud Backup helps managed service providers (MSPs) and IT teams back up and restore data such as email and files in cloud environments including Microsoft 365 and Google Workspace. For Microsoft 365, it relies on permissions granted through Microsoft Entra ID. A service principal is the identity that represents an application inside a customer tenant and lets it use the permissions that were granted.
Todyl researchers said the attacker authenticated directly to Microsoft 365 as the backup application, using its secret, and so inherited the permissions each customer had already granted. The sign-ins came from an automated script and involved no user login, so protections such as multi-factor authentication (MFA) did not apply.
Todyl said those permissions gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats. In the nine tenants Todyl analysed, researchers identified only sign-in activity. How much data was actually accessed or changed across all affected tenants has not been disclosed.
Who is affected
Organizations that used ConnectWise Cloud Backup or SkyKick for Microsoft 365 backups, and the MSPs that manage them, are the ones to check first. The full number of affected tenants has not been disclosed; 162 is only the figure Huntress saw in its own environment. Whether other services or non-Microsoft platforms were touched has not been stated.
Indicators and detection
The single source IP reported across the sources, defanged:
144.172.64[.]128
Treat one IP as a starting point, not a complete list. The reporting does not include other indicators.
Why this matters
This section is our analysis, not new reporting. A backup tool that holds broad, long-lived permissions in many tenants is an attractive single point of failure, because compromising the vendor’s application secret can open every customer at once. Sign-ins as an application do not trigger user-focused controls such as MFA, so detection has to rely on service principal sign-in logs and role-change alerts. Dormant integrations, like an app nobody has used in years, keep their permissions until someone removes them.
What to do
- Check whether your tenant has a SkyKick or ConnectWise Cloud Backup service principal, and list the permissions it holds.
- Review Entra ID service principal sign-in logs and audit logs from October 15 onward, including any sign-ins from the IP above and any role assignments made by the app, such as Exchange Administrator.
- Look for unexpected mailbox, OneDrive, SharePoint and Teams access or changes made by the application identity.
- If you no longer use the backup service, remove the app’s access and consent. If you do, follow ConnectWise’s advisory before restoring access.
- MSPs should notify affected clients and check the ConnectWise advisory and Microsoft’s post for updates as the investigation continues.
The facts above come from a single outlet’s reporting of ConnectWise, Microsoft, Huntress and Todyl statements, and details may change as the investigation continues.
