Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

ConnectWise suspends Cloud Backup after stolen app secret hits Microsoft 365

10 sources · 10 articlesFirst reported Updated ()
What's new

October 20: Huntress reviewed sign-ins across more than 10,000 tenants and judged password-spray activity unrelated; Microsoft reported broad October 15 sign-ins, with no success after 05:00 UTC on October 17 in monitored environments.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ConnectWise Cloud Backup and two related services remain offline after a stolen app secret was used in customer Microsoft 365 tenants.

ConnectWise suspended Cloud Backup, formerly SkyKick, plus SaaS Security and Cloud Management after finding unauthorized access to application identities. Huntress says a compromised multi-tenant Microsoft 365 API secret obtained Entra ID tokens without customer passwords or MFA. In at least one tenant, a ConnectWise app made itself Global Administrator and added credentials. ConnectWise disabled seven identities, revoked certificates, and says monitored environments show no successful activity since containment and no evidence archives were accessed. Restoration timing is unset; planted credentials and earlier tokens may still work, and no actor is named.

Key facts
  • Seven Cloud Backup application identities were disabled and certificates revoked on October 17.
  • Huntress confirmed unauthorized sign-ins in 162 tenants; about 300 of nearly 1,000 attempts succeeded.
  • Sign-ins used 144.172.64.128 between 06:13 and 08:34 UTC on October 15.
  • Huntress cited application ID 24205314-2b89-4e07-a2a4-579e898a5640.
  • In one tenant, added app credentials were set valid until 2028.
  • ConnectWise says archives stay encrypted with no evidence of unauthorized access.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 13, 2026Password-spray activity hit four law firms, Huntress says. · The Record
  2. Oct 14, 2026ConnectWise says it found unauthorized access to application identities. · Security Affairs
  3. Oct 15, 2026Graph tokens obtained from 144.172.64.128 between 06:13 and 08:34 UTC. · SecurityWeek
  4. Oct 16, 2026Huntress confirmed unauthorized sign-ins across 162 tenants. · CSO Online
  5. Oct 17, 2026Seven identities disabled and cloud services suspended from 05:00 UTC. · The Hacker News
  6. Oct 18, 2026Backups, archive access, and restores still unavailable at 16:00 UTC. · The Register

What each outlet adds

beyond the shared facts
  • The RegisterPublished the abused application ID and integration shutdowns.
  • Help Net SecurityOne tenant’s new credentials were valid until 2028.
  • CSO Online162 confirmed tenants as of 19:00 UTC on October 16.
  • The RecordOctober 13–14 password spray against four law firms.
  • The Hacker NewsOnly one external IP plus Microsoft ranges signed in across 10,000-plus tenants.
Vendors
ConnectWiseMicrosoft
Products
ConnectWise Cloud BackupMicrosoft 365Exchange OnlineMicrosoft TeamsSharePoint OnlineCloud BackupSaaS SecurityCloud ManagementMicrosoft Entra IDSkyKick
Victims
ConnectWise
Organizations
HuntressTodylCoreViewSpecterOps

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Register · SecurityFirst report

    ConnectWise suspends Cloud Backup after unauthorized app-identity access

    Huntress says a stolen Cloud Backup Microsoft 365 API secret was used in customer tenants.

  2. · 6d ago Security Affairs

    Stolen ConnectWise app credentials used against Microsoft 365 tenants

    Seven application identities were disabled and Cloud Backup suspended; Huntress saw about 300 successful sign-ins.

  3. · 6d ago Infosecurity Magazine

    ConnectWise takes cloud services offline after Microsoft 365 access

    Unauthorized access to Cloud Backup application identities was found after October 15; restoration timing and any data theft remain unconfirmed.

  4. · 6d ago CSO Online

    ConnectWise backup credential used to enter Microsoft 365 tenants

    Huntress reported suspicious sign-ins across 162 organizations; ConnectWise disabled seven app identities and three cloud services.

  5. · 6d ago SecurityWeek

    ConnectWise suspends cloud services after M365 tenant access

    Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.

  6. · 6d ago Help Net Security

    ConnectWise suspends Cloud Backup after attackers abuse Microsoft 365 access

    Huntress saw the stolen app credential sign into at least 162 Microsoft 365 tenants on October 15; earlier tokens may still work.

  7. · 6d ago Dark Reading

    ConnectWise disables Cloud Backup after Microsoft 365 logins

    Researchers say ConnectWise credentials signed into customer Microsoft 365 tenants; downstream impact is unconfirmed.

  8. · 6d ago The Record

    ConnectWise suspends Cloud Backup after supply-chain credential attack

    Huntress saw unauthorized sign-ins in 162 Microsoft 365 tenants after attackers used the backup app’s permissions.

  9. · 5d ago The Hacker News

    ConnectWise resets Cloud Backup credentials after unauthorized access

    Huntress saw vendor-credential sign-ins from 144.172.64.128, then Global Administrator grants and new secrets on two tenants.

  10. · 5d ago CyberScoop

    ConnectWise Cloud Backup API secret used against Microsoft 365 tenants

    Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.