ConnectWise suspends Cloud Backup after attackers used its app identities

ConnectWise suspends Cloud Backup after attackers used its app identities

17 October 2026: ConnectWise has switched off Cloud Backup, the service it acquired as SkyKick, for all partners after unauthorized access to the application identities that connect the service to customers' Microsoft 365 environments. Backups are not running and cannot be restored until further notice. As of 17 October the company says it has no indication that backup data was compromised.

Not yet independently verified. ConnectWise's status page gives no count of affected tenants. Outlet reports say 173 Microsoft 365 tenants were accessed, which we could not confirm from a primary source; as of 17 October no restoration time had been given. We will update this when it can be confirmed, and remove this note.

How the incident unfolded

The first post on ConnectWise's status page came at 1:48 PM EDT on 16 October. It reported an investigation into recent attempts at unauthorized access linked to the Cloud Backup environment, with containment in place and no indication that partner backup data had been accessed.

At 1:11 AM EDT on 17 October the status moved to identified. ConnectWise said it had found unauthorized access to application identities in the environment and was shutting off Cloud Backup application access as a protective measure, which interrupts backup services.

The third update, at 1:04 PM EDT on 17 October, said the service had been suspended by revoking the certificates used for the affected application connections across all users. The shared credentials previously used for Cloud Backup are no longer valid.

What ConnectWise says about the data

ConnectWise says Cloud Backup archives "remain encrypted and isolated" and that it has no evidence they were accessed. The archive is not affected by the interruption and will be accessible when the service returns. Since the mitigations, it says, no successful threat activity has been observed in the environments it monitors.

The company has mobilised its security operations centre and engaged a third-party incident response firm that it does not name. It says the investigation covers all partner-facing services and that there is no indication any other ConnectWise product, service or offering is affected.

Checking your own tenant

Cloud Backup's configuration gives ConnectWise no visibility into partners' and customers' Microsoft 365 environments, so it cannot tell whether a particular tenant was touched. Partners must look themselves. The status page gives these steps:

• open the Microsoft Entra admin center, go to Monitoring and then Sign-in logs, and choose the Service principal sign-ins tab
• filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae
• look for IP addresses outside the expected Microsoft and Azure ranges, because normal egress is Azure private IPv6

The indicators published on 16 October are source IP address 144.172.64.128 and the user agents Python-urllib/3.12 and python-requests/2.31. ConnectWise notes that seeing one of them does not on its own confirm unauthorized activity. Suspicious activity should be reported to SecurityPartnerSupport@ConnectWise.com.

What outlets report

BleepingComputer reports that attackers used the application identities to compromise Microsoft 365 tenants. The Hacker News reports that a compromised credential belonging to Cloud Backup, formerly SkyKick, was used to sign in to 173 tenants. ConnectWise's own page carries no tenant count.

The investigation is in a second phase. ConnectWise promised a further update later on 17 October through its Trust Center and Partner Care, and gave no time for restoring the service.

Related on TrustList:

• Commvault patches critical command execution flaw in its CVFS storage

Sources

• ConnectWise status page: ConnectWise Cloud Backup Issue Investigation (updates of 16 and 17 October, read 2026-10-17), 17 October 2026
• BleepingComputer: hackers breach Microsoft 365 tenants via ConnectWise supply chain attack (summary only), 17 October 2026
• The Hacker News: hackers use compromised ConnectWise credential (summary only), 17 October 2026