ConnectWise attack hits Microsoft 365 environments
A stolen ConnectWise Cloud Backup access credential was used for unauthorised logins to customer environments.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
An attacker exploited an access credential from ConnectWise Cloud Backup (formerly SkyKick). According to security researchers, dozens to potentially hundreds of Microsoft 365 environments were accessed; ConnectWise has disabled the application involved.
ConnectWise announced on 16 October that it was investigating a security incident involving Cloud Backup. The company subsequently took protective measures and disabled access to the application involved. According to ConnectWise, the service is used by IT service providers managing customers’ Microsoft 365 environments.
Security company RedEye Security reported that a stolen application credential was used to request Microsoft Graph tokens. This enabled attackers to log in to customer environments without having to crack a user password separately for each environment.
The researchers name 173 partner and customer environments in which unauthorised logins were identified. That figure comes from third-party research and has not been independently confirmed by ConnectWise. ConnectWise says instead that it has no independent visibility into whether individual customer environments actually experienced unauthorised activity.
The company has asked partners to check logs for unusual logins, new application credentials, changed permissions and unexpected access to mailboxes, SharePoint or other Microsoft 365 data. The recommendations apply particularly to organisations using Cloud Backup or the older SkyKick integration.
The case shows how misuse of a service provider’s application credential can spread to multiple customer environments. The impact has not yet been fully established. ConnectWise says it has so far found no indications that backup data on its own platform was taken, but that does not rule out unauthorised access to individual Microsoft 365 environments.
For Dutch organisations, the dependency chain is particularly relevant: a supplier with broad application rights can gain access to many customer environments at once. Security teams should therefore check not only their own user accounts, but also old integrations and permissions held by external service providers.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The core of the incident has been confirmed by ConnectWise and an independent security source. The scope is clearly marked as externally reported.
- confirmed ConnectWise Cloud Backup was disabled after unauthorised access. — This is stated in ConnectWise’s official advisory. source
- confirmed A stolen application credential was used to access Microsoft 365 tenants. — Described by RedEye Security and confirmed as an investigative line in external security reports. source
- uncertain Unauthorised logins were identified at 173 tenants. — This figure comes from external research and has not been independently confirmed by ConnectWise. source
Editor's note
ConnectWise confirms the incident and the shutdown of the service. The figure of 173 affected tenants comes from external research and has not been independently confirmed by ConnectWise.Sources
- Trust Center: Cloud Backup service interruption — ConnectWise
- Stolen ConnectWise Cloud Backup Credential Used to Sign In to 173 Microsoft 365 Tenants — RedEye Security
- ConnectWise Investigating Unauthorized Access to Cloud Backup App — Coalition Security Labs
More on this in Dutch media
- Tweakers — „connectwise cloud backup”
- AD — „connectwise cloud backup”
- RTL Nieuws — „connectwise cloud backup”