CONNECTWISE reports unauthorized access to Cloud Backup identities (formerly SkyKick) tied to its Microsoft 365 integration. A vendor-controlled application credential was compromised and used to obtain Microsoft Graph tokens in multiple customer tenants, enabling the attacker to act as the Cloud Backup application within those environments. In response, ConnectWise disabled seven application identities and suspended Cloud Backup, SaaS Security and Cloud Management while it investigates and remediates.
Technical details seen by researchers show activity beginning at least on 15 October 2026, with the initial suspicious sign-ins originating from the IP 144.172.64[.]128 rather than ConnectWise’s usual Azure private infrastructure. The exposure involved a client assertion credential rather than a user password, meaning the attacker could request tokens with permissions already granted to the application in each tenant.
Investigators describe the incident as unauthorized access to workload identities and service principals, with some reporting that a Cloud Backup API secret appeared to be in hostile hands. ConnectWise notes that while existing Cloud Backup archives remain encrypted and preserved, it cannot confirm whether live tenant data was accessed, and emphasises that remediation must address all compromised app identities, credentials, and permissions across tenants.