Summary
- Environment: ConnectWise Cloud Services and customer Microsoft 365 tenants
- Operational impact: Backups, restores and selected management services suspended
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 18, 2026; updated as evidence emerges.
What happened
ConnectWise confirmed unauthorized access to application identities associated with Cloud Backup, formerly SkyKick. Its October 18 advisory update reported continuing service interruptions. [2]
Huntress confirmed misuse of a vendor credential to authenticate to customer Microsoft 365 environments on October 15. [1]
Impact
Huntress’s October 17 update reported almost 1,000 Entra tenants with activity from the associated address and over 300 successful sign-ins. These are telemetry observations, not a count of people or stolen records. [1]
Scheduled backups and affected archive access and restores were unavailable. ConnectWise also paused SaaS Security and Cloud Management, interrupting monitoring, alerting, and user and license management. No restoration time was available. [2]
The vendor said backup archives remained preserved with no evidence of access. That assessment does not resolve potential access to live customer data. [2]
Timeline
Issue identified
ConnectWise dates detection to October 14.
[2]Customer-tenant access observed
Huntress observed unauthorized application authentication.
[1]Identities disabled
Seven application identities were disabled at 07:00 UTC.
[2]Service interruption expanded
The vendor reported precautionary pauses for additional services.
[2]Briefing updated
This briefing was last reviewed and updated on October 18, 2026.
Threat Group & Attack Vector
Huntress observed a Cloud Management application grant itself Global Administrator and add credentials to two other applications in one tenant. It removed the unauthorized credential from its own application on October 16 after seven sign-ins. The operator behind the private Azure address remained unresolved. [1]
Todyl’s investigation independently confirmed application-only authentication. Its nine tenants without active backup subscriptions showed no persistence; this is a different observation scope from Huntress’s. [1][3]
The original credential-acquisition method is not established.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078.004 — Cloud Accounts: compromised application credentials enabled authentication. [1]
- T1098.001 — Additional Cloud Credentials: credentials added to other applications preserved another access path. [1]
Response
ConnectWise revoked affected certificates and engaged forensic investigators. Issued tokens and separately planted credentials required further tenant-level review. [2]
Todyl could not reliably attribute reads in active-backup tenants without historical request-source logs. Confirmed authentication therefore does not settle whether data was copied. [3]