Your key hangs on your provider's key ring

What happened

Let me start with an everyday picture. You hand a copy of your house key to a cleaning company. Good company, you’ve used them for years. What you don’t know is that your key hangs on one big ring, next to a hundred other customers’ keys. Then one morning, someone copies the ring.

On 15 October 2026, that’s exactly what happened, just at business scale. ConnectWise’s Cloud Backup for Microsoft 365 (formerly SkyKick) backs up business email and files. To do that, it lives as an app inside every customer’s Microsoft 365 environment, their tenant. At some point it was granted permission to read all mail, OneDrive and SharePoint files, and Teams chats. The app signs in with the vendor’s own credential. That credential was stolen.

What struck me most: the attackers didn’t need a password. Multi-factor authentication (MFA) didn’t stop them either, because it wasn’t a person signing in. It was an app. Early on 15 October (UTC), they requested access in the backup software’s name, scripted, tenant after tenant.

I’m taking the numbers from security firm Huntress, which published the most detailed analysis. Unauthorized access was confirmed in at least 162 tenants (the press later reported 173), with attempts against nearly 1,000. In two tenants, the attacker used another ConnectWise app to grab Global Administrator rights and left spare credentials on other trusted apps, valid until 2028. The same day, a more targeted second wave went after 16 organisations in policy, national security and critical minerals. Most of them didn’t even use ConnectWise products, so those attempts largely failed.

On 21 October 2026, Microsoft added a third number from its wider view: with the ConnectWise access, the attackers tried to sign in to more than 2,250 tenants. Most attempts failed, but according to Microsoft they gained persistent, privileged access at several organisations: swapping app credentials, changing roles and bulk-reading secrets stored in the cloud.

ConnectWise revoked and rotated the credentials, disabled the affected apps and brought in outside incident responders. The vendor says backup archives weren’t accessed. But it can’t see into customers’ live mail and files. Huntress found no mailbox or file changes in the two compromised tenants, yet this kind of reading doesn’t always leave a trace in the logs. Whether data was taken is still unknown. So is how the credential leaked.

Who might be behind it is no longer a blank, though. According to Microsoft’s 21 October analysis, it was Storm-0940, a China-state-aligned group that used ARTEX, an AI-agent attack framework released as open source. The agents move from reconnaissance to privilege with little human input, down several paths at once. In the wider campaign running since September, Microsoft says it took under three hours in several cases from first targeting to privileged access. That’s Microsoft’s assessment; according to The Record, China’s foreign ministry denied any knowledge of the incidents.

I saved a bitter twist for last: as a precaution, Cloud Backup was down from 17 October, SaaS Security and Cloud Management from 18 October, and customers could neither back up nor restore. On 21 October ConnectWise began a phased restoration gated by security checks, but the vendor says full recovery will take several days, and as of 22 October there were no per-service reconnection instructions yet.

Why it matters to you

If your company runs Microsoft 365 and an outside IT partner (an MSP, managed service provider) manages it, you’ve probably already put a key on someone’s ring without knowing it. These permissions live for years, even after you’ve cancelled the service. And whoever gets hold of such a key no longer tries things by hand: according to Microsoft, AI agents did the work in this case, at machine speed.

The lesson isn’t about ConnectWise. Attackers increasingly go after the machine-to-machine trust between services rather than your password, because MFA doesn’t help there and logging is weaker. The EU’s NIS2 directive explicitly requires in-scope companies to manage supply-chain security. So responsibility stays with you even when the work is outsourced.

There’s a second lesson: your backup is a supplier too. Cyber insurer Coalition warns that if another incident, say ransomware, hits during the no-backup window, recovery gets much harder. If your backup provider went dark for a week starting tomorrow, do you know how you’d back up in the meantime?

No impact in Hungary is known yet, and no source has published a country breakdown. The service is sold through MSPs worldwide, including to small businesses across Central Europe.

Red // attacker's view

I didn’t care about your password. Or your MFA. I came in the name of a backup tool, and its whole job is to read everything.

Three things worked for me. One key, many locks: the backup app has a single identity that works for every customer who ever approved it. Whoever holds the key can walk the list, and according to Sophos it likely included tenants without an active subscription. Free camouflage: backup reads mail and files in bulk, so malicious reading looks exactly like normal operation. Poor visibility: app-level reads don’t always leave an audit trail, and free Entra ID keeps sign-in logs for only seven days.

The nastiest part is the spare key. Once a trusted app gets admin rights, it can add new credentials to other apps. You can lock the original door; I’ll come back through another. So disabling isn’t undoing: cutting the connection doesn’t clean up what I left behind.

Blue // what to do now

Small business with an outside IT partner

Ask your IT partner today: is there any ConnectWise or SkyKick app in your Microsoft 365, even an old, unused one? If so, have it disabled (not deleted) until the vendor formally says it’s safe to switch back on.
Before disabling, have them export the logs and the app’s permissions: the free tier keeps them for only seven days.
Ask whether any app received an admin role or a new secret since 13 October 2026.
Set up a temporary backup of critical mailboxes and files until Cloud Backup is fully restored.
If you have cyber insurance, check whether you need to report this, and preserve the logs.

In-house IT or MSPs

Disable (don’t delete) the Cloud Backup and Cloud Management apps in every tenant, and only re-enable them after ConnectWise’s formal per-service instructions. Preserve the Entra and Purview logs first: Microsoft says to capture evidence before any irreversible step.
Review Entra “Service principal sign-ins” (not user sign-ins!) back to 1 October, as Microsoft recommends: successful and failed sign-ins separately, filtered by application ID, and not only for the published IP addresses.
Review the audit log for role assignments, consents and new credentials on every app; revoke any Global Administrator rights you didn’t intend to grant.
Turn on Microsoft Graph activity logs and extend log retention; it isn’t retroactive, so do it now.
Keep an inventory of every external multi-tenant app, its permissions and its owner, and ask your IT partner once a year: who have you granted access in my name, and which of those do we still need?

For professionals: technical details

CVE: none. Current evidence points to credential compromise, not a disclosed vulnerability; the vendor says it’s not yet known whether a product flaw played a role.
Affected components: the ConnectWise Cloud Backup (SkyKick) Microsoft 365 enterprise app and the Cloud Management app family (MS Teams, Exchange Online, MS Graph, Partner Center, SharePoint Online); seven app identities disabled in total. Older tenants may list them as “SkyKick Cloud Manager”.
Authentication: OAuth 2.0 client credentials (app-only token) using a credential stored in the vendor tenant. Per Microsoft, Directory.ReadWrite.All was likely abused; per Todyl, mail, file and Teams read/write plus full EWS mailbox access were available.
Actor: according to Microsoft’s assessment, Storm-0940 (China-state-aligned, tracked since 2021), using the ARTEX multi-agent AI pentesting framework. Microsoft does not describe the initial access either.
MITRE ATT&CK (Huntress): T1078.004 Valid Accounts: Cloud Accounts; T1098.003 Additional Cloud Roles; T1098.001 Additional Cloud Credentials. Per Microsoft, also: T1595 Active Scanning; T1195 Supply Chain Compromise; T1199 Trusted Relationship; T1528 Steal Application Access Token; T1555.006 Cloud Secrets Management Stores; T1087.004 Cloud Account; T1580 Cloud Infrastructure Discovery.
Detection ideas: service principal sign-ins from public hosting ranges; an app assigning itself a role or adding credentials to another app; issued tokens stay valid for roughly 60–90 minutes after disabling.
Indicators: the full official list is in the Microsoft, Huntress and Todyl write-ups and on the ConnectWise status page. Note: the Cloud Backup app ID is legitimate; don’t blocklist it, just disable the app.
Hardening: app management policies for secret lifetimes, a narrower Application Administrator and Cloud Application Administrator group, Exchange RBAC for applications, and where licensing allows, Conditional Access and Entra ID Protection for workload identities. Background: the joint ASD/CISA/NCSC MSP advisory.

Péter // the chief's note

In my view, third-party ICT risk is one of the biggest risks a company faces today. The ConnectWise case shows exactly why: the affected businesses didn’t get weaker on their own side. A supplier’s key ended up in the wrong hands. A key they had never seen, and whose protection they had no say over.

Controlling this risk properly is very hard. We rarely get to look inside a provider’s operations, so in the vast majority of cases all we have are legal tools: the contract, the liability terms, the damages clause. And enforcing them is questionable at best.

Which brings me to the big question: does a successful legal claim console anyone if, in the meantime, their business has been at a standstill for days or weeks? Cloud Backup customers have been working without backups since 17 October, and nobody can say for how long. Downtime doesn’t just cost money. Customers’ patience and trust can run out too, and a business can go under because of lost trust. You might win the lawsuit, but by the time the verdict arrives, there may be nothing left to save.

That’s why the contract is only the last line of defence. The first one is knowing who you’ve handed a key to in your name, what it opens, and what you’ll do if that key ever falls into the wrong hands.

Background report for professionals

The full research in one PDF

Timeline, actors, how the attack works, actions for each audience, technical details and source assessment. All in one place, printable and easy to pass on.

PDF · 14 pages · 271 KB · research revision v3

Open the PDF (English) Magyar eredeti (PDF)

Sources

Made with an AI crew, reviewed by Péter