ConnectWise has temporarily suspended customer access to its Cloud Backup platform following a security breach that allowed attackers to infiltrate Microsoft 365 environments. The company identified unauthorized access to application identities, which were then exploited to compromise downstream tenants hosted on Microsoft’s collaboration suite.
What happened
The breach was detected after anomalous activity was traced to ConnectWise’s Cloud Backup service, formerly known as SkyKick Cloud Backup. Attackers leveraged stolen application credentials to gain entry to Microsoft 365 tenants linked to the platform. ConnectWise responded by shutting down the affected service to prevent further exposure, though the full scope of compromised tenants remains unclear. No timeline has been provided for service restoration or a complete forensic investigation.
For professionals: Operators using ConnectWise Cloud Backup should audit Microsoft 365 tenant permissions, revoke any unused or suspicious application identities, and monitor for unauthorized access. Third-party integrations remain a high-risk vector for supply chain attacks.
What we don’t know yet
Sources did not specify how the application identities were initially compromised, whether customer data was exfiltrated, or the number of affected tenants. ConnectWise has not disclosed whether the breach originated from an internal misconfiguration, a vulnerability in its software, or a targeted attack on its infrastructure. The incident’s impact on backup integrity and data recovery capabilities is also unconfirmed.
Companies mentioned
Automated pipeline · Security
Synthesized from 1 industry feed on 17 Oct 2026. Passed independent editor verification (score 85/100) before publication. Style guide v1.4.
Sources
Decision trail
- Checking for duplicates — Deduped batch of 1 candidates
- Checking for duplicates — New story No previously published or in-pipeline article covers this ConnectWise supply-chain attack on Microsoft 365 tenants.
- Checking for duplicates — New story pre_write:; No previously published or in-pipeline article covers this ConnectWise supply-chain attack on Microsoft 365 tenants.
- Writing the article — Brief only thin sources; quick-read mode
- Writing the article — Draft created article_id=719 slug=connectwise-cloud-backup-breach-exposes-m365-tenants quick_read=1
-
Editor review — Approved
- Score: 85/100
- Factual grounding: The draft states 'No timeline has been provided for service restoration or a complete forensic investigation,' but the source does not explicitly confirm this. The source only mentions the shutdown without detailing the status of the investigation or restoration timeline.
- Style compliance: The standfirst ('Hackers used stolen app identities to access Microsoft 365 customers via ConnectWise') slightly deviates from neutral tone by implying intent ('used stolen') without explicit source attribution. Rephrase to match source phrasing ('accessed application identities').
- Quote integrity: The 'For professionals' block is not a verbatim quote and does not require blockquote formatting. However, it is correctly labeled as a callout and does not misrepresent source content.
- No copied phrasing: The phrase 'anomalous activity was traced to ConnectWise’s Cloud Backup service, formerly known as SkyKick Cloud Backup' closely mirrors the source ('ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup)'). Restructure to avoid echoing the source.
- Generating reader Q&A — Generated 3 items
- Assigning hero image — Rejected library image #25: The candidate depicts a government cloud data center in Belgium, which is unrelated to the article about a ConnectWise Cloud Backup breach exposing Microsoft 365 tenants. The description does not match the topic of a security breach or managed service provider (MSP) incident.
- Assigning hero image — Rejected library image #55: The candidate (index 0) is unrelated to the article topic. The description mentions a 'glass of beer' and 'microsoft office 365 security warning browser' is not a valid alt text match for the query. The URL slug and metadata do not align with the article about a ConnectWise Cloud Backup breach exposing M365 tenants. No candidate meets the minimum relevance threshold of 70.
- Assigning hero image — Reused library image reused image #2
- Linking related stories — Linked 5 relations from 363 candidates
- Publishing — Published connectwise-cloud-backup-breach-exposes-m365-tenants
- Mastodon — Posted https://mstdn.social/@hostingpaper/117457288025146700
Discussion · coming soon
Be the first to join the thread when community discussion launches.