Huntress has reported a widespread security incident involving ConnectWise Cloud Backup ...

X • October 17, 2026

PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants.

RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).

We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵

• Service principal sign-ins from app ID 506e08f9-6e9a-4da4-942b-a099a03644ae

Not using SkyKick or ConnectWise Cloud Backup? Revoke its app consents in your tenant.

Every app with consent in your tenant is a potential attack path. AzureHound, our open-source collector, maps Entra ID apps and their permissions:

GitHub - SpecterOps/AzureHound: Azure Data Exporter for BloodHound

Read the SpecterOps blog for remediation steps and updates:

ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ConnectWise Credential Compromise Exposes 173 Microsoft 365 Tenants On October 15, 2026, an unknown threat actor exploited compromised credentials from ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to 173 Microsoft 365 tenants. The attacker used the application's identity to authenticate and obtain Microsoft Graph tokens, allowing access to sensitive data across multiple organizations. The malicious activity was confirmed by Huntress, which reported unauthorized sign-ins from the IP address 144.172.64[.]128. ConnectWise has since shut down application access and is investigating the incident, but has found no evidence that partner backup data was compromised. Organizations using the app are advised to disable it immediately to prevent further unauthorized access. The attack highlights vulnerabilities in supply-chain security, where trusted applications can become entry points for attackers. The incident is ongoing, with updates being provided by affected parties. 9 sources 72

Extracted Entities

Huntress has reported a widespread security incident involving ConnectWise Cloud Backup ...

The full story

Extracted Entities

Attack Types (1)

Companies (2)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)