Steven Lim on X: " Connectwise Credential Abused Incident ...

X • October 17, 2026

A widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick) enabled an unknown threat actor to leverage compromised SkyKick access to gain access to customers’ Microsoft 365 environments. If you uses ConnectWise Cloud Backup, you can run the below KQL to check for possible exposure. 🫡

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ConnectWise Credential Compromise Exposes 173 Microsoft 365 Tenants On October 15, 2026, an unknown threat actor exploited compromised credentials from ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to 173 Microsoft 365 tenants. The attacker used the application's identity to authenticate and obtain Microsoft Graph tokens, allowing access to sensitive data across multiple organizations. The malicious activity was confirmed by Huntress, which reported unauthorized sign-ins from the IP address 144.172.64[.]128. ConnectWise has since shut down application access and is investigating the incident, but has found no evidence that partner backup data was compromised. Organizations using the app are advised to disable it immediately to prevent further unauthorized access. The attack highlights vulnerabilities in supply-chain security, where trusted applications can become entry points for attackers. The incident is ongoing, with updates being provided by affected parties. 41 sources 72

Extracted Entities

Steven Lim on X: " Connectwise Credential Abused Incident ...

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Platforms (2)