One Stolen Password Just Opened 173 Microsoft 365 Accounts

Michael Miller · 2026-10-17

A single compromised password. That's all it took for unknown attackers to slip into 173 Microsoft 365 tenants. No exploit, no zero-day, no sophisticated malware. Just one credential that wasn't supposed to fall into the wrong hands. Here's what happened and why it should make you rethink how you protect your own cloud accounts. ### The Backdoor You Didn't Know You Had ConnectWise Cloud Backup (formerly SkyKick) is a cloud backup service that managed service providers (MSPs) use to protect their clients' Microsoft 365 data. It's a handy tool—until someone else gets the keys. According to cybersecurity researchers, threat actors are actively abusing a compromised Microsoft 365 credential tied to ConnectWise Cloud Backup. With that one credential, they can sign in to customers' M365 environments as if they were the service itself. It's like a master key that opens every door in the building. > "The most dangerous breaches often start with the simplest mistakes—a reused password, a missing MFA prompt, a third-party tool that's trusted a little too blindly." That quote isn't from a vendor blog. It's the reality of modern cloud security. When you trust a third-party service with access to your data, you're also trusting their security posture. And sometimes that trust is misplaced. ### Why 173 Tenants Is Just the Beginning 173 might not sound like a huge number, but consider this: each tenant represents an entire organization. That's 173 companies whose email, files, and collaboration tools were potentially exposed. And the attackers didn't need to break in—they just walked through the front door. What makes this worse is the ripple effect. MSPs often manage dozens or hundreds of clients. If an MSP's backup tool is compromised, every one of their clients is at risk. It's a supply chain attack disguised as a credential leak. So far, the attackers' motives aren't clear. They could be stealing data, planting ransomware, or simply selling access to other criminals. Either way, the damage is done. ### How to Protect Your Own M365 Environment You can't control what a third-party vendor does, but you can control your own security hygiene. Here's what you should do right now: - **Enable multi-factor authentication (MFA) everywhere.** Especially on accounts with admin privileges. It's not foolproof, but it stops most credential-based attacks cold. - **Audit third-party app access.** Review which apps and services have permission to access your M365 data. Remove anything you don't recognize or no longer use. - **Use unique, strong passwords.** Never reuse passwords across services. A password manager makes this painless. - **Monitor for unusual sign-ins.** Set up alerts for logins from unfamiliar locations or devices. Early detection can limit the blast radius. - **Ask your MSP about their security practices.** If they use tools like ConnectWise Cloud Backup, ask how they protect those credentials. Don't be afraid to push for details. ### The Bottom Line This incident isn't about a fancy hack. It's about a stolen password and a trusted service that became a gateway. In a world where we rely more and more on cloud tools, the weakest link is often the one we overlook. Take a few minutes today to check your MFA settings and review third-party access. It might feel like busywork, but it's the kind of busywork that keeps you out of the headlines.