On Friday evening, 16 October 2026, a widespread security incident was disclosed affecting ConnectWise Cloud Backup, the product formerly known as SkyKick Cloud Backup. If your business or your IT provider uses this product to back up Microsoft 365 data, you need to act today. Attackers have used a compromised vendor credential to access customers’ Microsoft 365 tenants, and more than 100 tenants have been confirmed compromised so far.
Note for Blowfish Technology clients: You are not affected by this incident. We do not deploy ConnectWise Cloud Backup or SkyKick in any of the Microsoft 365 tenants we manage. The guidance below is for the wider UK business community and anyone whose IT provider may use this product.
What has happened
ConnectWise published a security advisory on its status page at approximately 6:48 PM UK time on 16 October 2026, saying it was investigating “recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment.” Within hours, Huntress sent a rapid response notification to its Microsoft 365 managed partners at around 20:20 BST, confirming that an unknown attacker was pivoting from the vendor’s environment directly into customers’ Microsoft 365 tenants.
“Unknown threat actor abused the access they obtained in SkyKick to pivot to access customers’ Microsoft 365 environments.”
Huntress Rapid Response advisory, 16 October 2026
The attacker’s access is not through a user signing in. It is the application itself signing in using its vendor credential. That distinction matters because most monitoring, including Huntress’s standard offering, does not watch service principal sign-ins without a Microsoft Entra ID P1 or higher licence. Many SMEs with Microsoft 365 Business Premium or lower are therefore blind to this activity by default.
ConnectWise’s own position, published on its status page, is cautious: it has “no indication that partner backup data has been accessed.” That statement refers to the backup data stored by ConnectWise itself. It does not address whether attackers used the application’s access to pivot into live Microsoft 365 tenants, which both Huntress and ThreatLocker have confirmed is happening.
Why this matters for UK businesses
Your business may not use ConnectWise Cloud Backup directly, but your IT provider might. The product is widely used by UK MSPs to back up Microsoft 365 data for their clients, which means a single compromised credential can expose hundreds of downstream tenants at once.
The application itself has broad access to the Microsoft 365 environment it was installed into. ThreatLocker, another security vendor tracking the incident, confirmed the compromised application has access to “customer email, Microsoft Teams, and SharePoint data.” For a business owner, that is the whole of your communications and collaboration estate.
If you run a UK business with 20 to 100 staff, your Microsoft 365 tenant probably holds your HR records, your client correspondence, your contract library, your finance exports, your supplier bank details, and your management meeting minutes. Any attacker with the vendor’s credential can reach the lot without triggering a user login alert.
The timeline so far
- Thursday 15 October 2026, around 02:04 UTC: An MSP posted to the r/msp community that it had received a Microsoft Privileged Identity Management notification. A dormant SkyKick Cloud Manager service principal had assigned itself the Exchange Administrator role, outside PIM, with itself listed as the assigner. This was the first public indicator of trouble, roughly 40 hours before the ConnectWise advisory.
- Friday 16 October 2026, 17:47 UTC (6:48 PM BST): ConnectWise published its investigating advisory on its status page.
- Friday 16 October 2026, around 20:20 BST: Huntress emailed its managed partners with a rapid response alert, including a list of affected Microsoft 365 tenant IDs and clear remediation steps.
- Overnight into Saturday 17 October: ThreatLocker and other industry security vendors published their own advisories, confirming data exfiltration via the application’s permissions.
- Saturday 17 October onwards: Investigation ongoing. ConnectWise has not yet named the attacker, confirmed the full scope, or set a remediation date.
What to do right now
If your business or your IT provider uses SkyKick or ConnectWise Cloud Backup, work through the following today. If your IT is managed, call your provider this morning and ask them to confirm they have completed each step across every tenant they manage.
1. Find the application in Microsoft Entra
Open the Microsoft Entra admin centre and go to Enterprise applications. Search for “SkyKick Backup”, “ConnectWise Cloud Backup” or “CW Cloud Backup Service Provider”. If none of those names match, filter by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, which is the identifier ConnectWise and Huntress have both published.
2. Disable it, do not delete it
Open the application record and go to Manage → Properties. Set “Enabled for users to sign-in” to No. This immediately blocks the application from doing anything in your tenant.
Do not delete the application. ConnectWise and the wider security community are advising a disable rather than a delete so that the application can be re-enabled quickly once ConnectWise confirms remediation. A full delete forces a complete re-consent flow afterwards.
Disabling will pause your Microsoft 365 backups until the application is re-enabled. For most businesses, pausing backups for a few days is a safer position than leaving a compromised application with full tenant access.
3. Check your sign-in logs for signs of compromise
Still in the Entra admin centre, go to Monitoring → Sign-in logs. Switch to the Service principal sign-ins tab. This is not the default view, which only shows user sign-ins and will miss this activity entirely. Filter by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
Known indicators of compromise, published by ConnectWise and confirmed by third-party security vendors:
- Source IP address: 144.172.64.128
- Observed user agents: Python-urllib/3.12 and python-requests/2.31
If you see sign-ins from that IP address or either of those user agents, treat it as a confirmed compromise and begin a proper incident response: scope the data the application could reach, review mailbox and SharePoint audit logs for suspicious activity in the window since the first indicator on 15 October, and consider engaging an incident response firm if the exposure is material.
4. Review what the application could reach
On the application record in Entra, open Permissions and review the Microsoft Graph scopes granted. ConnectWise Cloud Backup typically has broad permissions including mailbox read and write, SharePoint files read and write, and directory read. Everything the application was consented to is in scope for your incident response.
The lesson for every business, not just affected ones
Vendor compromise is not a theoretical risk. Every application you authorise in Microsoft 365 is a potential route for an attacker who compromises the vendor. The more applications your tenant has consented to, the more routes exist, and most SMEs have no visibility into service principal activity at all.
Three things worth doing this quarter, whether or not you use ConnectWise Cloud Backup:
- Audit your enterprise applications. Ask your IT provider for a current list of every third-party application consented to in your Microsoft 365 tenant, what permissions each one holds, and why it is there. Anything that cannot be justified should be removed. Pay close attention to applications with broad Microsoft Graph permissions such as Mail.ReadWrite or Files.ReadWrite.All.
- Turn on service principal monitoring. Standard user sign-in alerting does not catch what has happened here. If your Microsoft 365 licensing includes Entra ID P1 or P2, make sure service principal sign-in logs are being collected and reviewed. If it does not, this incident is a reasonable business case for upgrading, especially if you work in a regulated sector.
- Review your backup strategy. If a single compromised vendor can read the whole of your Microsoft 365 tenant, that is a concentration risk worth understanding. Backups stored outside Microsoft 365, isolated from the vendor credentials used to create them, give you a recovery option even in a worst-case scenario.
Need help today?
If you use SkyKick or ConnectWise Cloud Backup and would prefer someone to work through the disable, log review and incident scoping with you, call Blowfish Technology on 01695 351778 or email [email protected]. We will disable the application in your tenant, review the service principal sign-in logs for indicators of compromise, and give you a clear picture of what the exposure means for your business.
Blowfish Technology is a UK managed IT services provider based in Ormskirk, serving clients across the UK, with ISO 9001, ISO 27001, Cyber Essentials Plus and Microsoft Solutions Partner Modern Work status. We do not deploy SkyKick or ConnectWise Cloud Backup in any of the Microsoft 365 tenants we manage, which means our own clients are not among the affected. We can help if you have been.
Sources
- ConnectWise Product and Services Status: Cloud Backup Issue Investigation
- Huntress Rapid Response (X)
- ThreatLocker alert (X)
- Blumira: ConnectWise Cloud Backup (SkyKick) compromise
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.