--- title: "ConnectWise Cloud Services application-identity compromise" description: "Compromised ConnectWise application identities enabled Microsoft 365 access; backup and management services remained suspended on October 18." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-18" canonical_url: "https://www.ally.security/incidents/connectwise-cloud-services-identity-compromise-2026" markdown_url: "https://www.ally.security/incidents/connectwise-cloud-services-identity-compromise-2026.md" stix_url: "https://www.ally.security/incidents/connectwise-cloud-services-identity-compromise-2026/stix.json" --- # ConnectWise Cloud Services application-identity compromise ConnectWise suspended cloud services after application identities were abused to reach customer Microsoft 365 tenants. Last modified Oct 18, 2026 · 3 sources ## Summary - **Environment:** ConnectWise Cloud Services and customer Microsoft 365 tenants - **Operational impact:** Backups, restores and selected management services suspended - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [ConnectWise](https://www.connectwise.com/) confirmed unauthorized access to application identities associated with Cloud Backup, formerly SkyKick. Its [October 18 advisory update](https://www.connectwise.com/company/trust/advisories) reported continuing service interruptions. [2](#source-2) [Huntress](https://www.huntress.com/) confirmed misuse of a vendor credential to authenticate to customer [Microsoft 365](https://www.microsoft.com/microsoft-365) environments on October 15. [1](#source-1) ## Impact Huntress’s [October 17 update](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) reported almost 1,000 Entra tenants with activity from the associated address and over 300 successful sign-ins. These are telemetry observations, not a count of people or stolen records. [1](#source-1) Scheduled backups and affected archive access and restores were unavailable. ConnectWise also paused SaaS Security and Cloud Management, interrupting monitoring, alerting, and user and license management. No restoration time was available. [2](#source-2) The vendor said backup archives remained preserved with no evidence of access. That assessment does not resolve potential access to live customer data. [2](#source-2) ## Timeline ### October 14, 2026 — Issue identified ConnectWise dates detection to October 14. [2](#source-2) ### October 15, 2026 — Customer-tenant access observed Huntress observed unauthorized application authentication. [1](#source-1) ### October 16, 2026 — Advisory published The [advisory](https://www.connectwise.com/company/trust/advisories) was first published at 17:47 UTC. [2](#source-2) ### October 17, 2026 — Identities disabled Seven application identities were disabled at 07:00 UTC. [2](#source-2) ### October 18, 2026 — Service interruption expanded The vendor reported precautionary pauses for additional services. [2](#source-2) ### October 18, 2026 — Briefing updated This briefing was last reviewed and updated on October 18, 2026. ## Threat Group & Attack Vector Huntress observed a Cloud Management application grant itself Global Administrator and add credentials to two other applications in one tenant. It removed the unauthorized credential from its own application on October 16 after seven sign-ins. The operator behind the private Azure address remained unresolved. [1](#source-1) [Todyl’s investigation](https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app) independently confirmed application-only authentication. Its nine tenants without active backup subscriptions showed no persistence; this is a different observation scope from Huntress’s. [1](#source-1) [3](#source-3) The original credential-acquisition method is not established. ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1078.004 — Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/): compromised application credentials enabled authentication. [1](#source-1) - [T1098.001 — Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001/): credentials added to other applications preserved another access path. [1](#source-1) ## Response ConnectWise revoked affected certificates and engaged forensic investigators. Issued tokens and separately planted credentials required further tenant-level review. [2](#source-2) Todyl could not reliably attribute reads in active-backup tenants without historical request-source logs. Confirmed authentication therefore does not settle whether data was copied. [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks research · Huntress · Oct 16, 2026 ### ConnectWise Cloud Backup service interruption advisory official · ConnectWise · Oct 16, 2026 ### Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App research · Todyl · Oct 16, 2026
Evidence ledger Review the supporting structured claims. 1. **Used Product · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: ConnectWise Cloud Backup 2. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: In its October 17 5:15 PM ET update, Huntress reported sign-in activity from the associated address in almost 1,000 Entra tenants, with more than 300 successful sign-ins; these observations are not an affected-person or data-theft total. 3. **Resulted In · 100% confidence · current** Expanded service interruption reported: The vendor reported continued Cloud Backup suspension and precautionary SaaS Security and Cloud Management pauses. 4. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Huntress said the private Azure address associated with the credential-addition activity did not identify the operator; it had not tied that activity to the same operator as the public-address authentication activity. 5. **Resulted In · 100% confidence · current** Application identities disabled: ConnectWise disabled seven application identities at 07:00 UTC. 6. **Occurred At · 100% confidence · current** Expanded service interruption reported: 2026-10-18 7. **Used Attack Technique · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: https://attack.mitre.org/techniques/T1078/004/ 8. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Todyl reported that it could not reliably distinguish malicious read activity from normal backup activity for active subscriptions without historical Graph request-source logs. 9. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Vendor identified the issue 10. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: ConnectWise engaged an external forensic firm and said investigation and validation remained ongoing. 11. **Affected Organization · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: ConnectWise 12. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: ConnectWise said existing backup archives remained encrypted, isolated and preserved, with no evidence that those archives had been accessed; this assessment is separate from activity in live Microsoft 365 tenants. 13. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: ConnectWise warned that issued access tokens could remain usable until expiry or invalidation and that disabling the original applications did not remove separate unauthorized credentials or permissions inside customer tenants. 14. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Vendor advisory published 15. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Todyl independently observed successful application-only authentication on October 15 and analyzed nine affected tenants without active backup subscriptions. 16. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Application identities disabled 17. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Expanded service interruption reported 18. **Used Attack Technique · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: https://attack.mitre.org/techniques/T1098/001/ 19. **Occurred At · 100% confidence · current** Vendor advisory published: 2026-10-16 20. **Disclosed At · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: 2026-10-16 21. **Resulted In · 100% confidence · current** Vendor identified the issue: ConnectWise dates its identification of the issue to October 14. 22. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Huntress confirmed that a compromised ConnectWise Cloud Backup application credential was used to authenticate to customer Microsoft 365 tenants on October 15, 2026. 23. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Huntress removed the unauthorized credential from its single-tenant application on October 16 after it had been used for seven sign-ins. 24. **Occurred At · 100% confidence · current** Unauthorized customer-tenant authentication: 2026-10-15 25. **Discovered At · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: 2026-10-14 26. **Resulted In · 100% confidence · current** Unauthorized customer-tenant authentication: Huntress observed successful authentication using the compromised vendor application identity. 27. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: ConnectWise temporarily took SaaS Security and Cloud Management offline as a precaution, interrupting monitoring, alerting, and user and license management. 28. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: ConnectWise confirmed unauthorized access to application identities associated with Cloud Backup, formerly SkyKick. 29. **Occurred At · 100% confidence · current** Application identities disabled: 2026-10-17 30. **Resulted In · 100% confidence · current** Vendor advisory published: ConnectWise first published the advisory at 17:47 UTC. 31. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Unauthorized customer-tenant authentication 32. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: As of the October 18 update, scheduled backups, access to affected backup archives and restoration capabilities were unavailable; ConnectWise had not provided a restoration time. 33. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: ConnectWise disabled seven application identities at 07:00 UTC on October 17 and revoked certificates used for affected connections to suspend Cloud Backup. 34. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Todyl found no persistence or configuration changes in its nine-tenant analysis. 35. **Resulted In · 100% confidence · current** ConnectWise Cloud Services application-identity compromise: Huntress observed a ConnectWise Cloud Management application assign itself Global Administrator and add credentials to two other applications in one customer tenant on October 15. 36. **Occurred At · 100% confidence · current** Vendor identified the issue: 2026-10-14