One Stolen Password Opened 173 Microsoft 365 Accounts

Emily Davis · 2026-10-17

Imagine a single key that unlocks the front doors of 173 different houses. That's essentially what happened when attackers got their hands on a compromised credential for ConnectWise Cloud Backup, a tool used by managed service providers (MSPs) to protect their clients' Microsoft 365 data. According to cybersecurity researchers, unknown threat actors used that one credential to sign in to 173 separate Microsoft 365 tenants. If you're an MSP or a business relying on one, this story is a wake-up call. ### What Exactly Happened? ConnectWise Cloud Backup, formerly known as SkyKick, is a cloud-to-cloud backup and recovery service. MSPs use it to keep their customers' email, OneDrive, SharePoint, and Teams data safe. But because it's a multi-tenant platform, one set of credentials can access many customer environments. That's convenient for management, but it's also a huge risk if those credentials fall into the wrong hands. In this case, someone did get access. Researchers haven't revealed how the credential was compromised, but the result was clear: attackers signed in to 173 Microsoft 365 tenants. We don't yet know what they did once inside, but the potential for data theft, ransomware, or further compromise is enormous. ### Why This Matters to You If you run an MSP, you're a prime target. You hold the keys to dozens or hundreds of client environments. A single slip-up—a reused password, a phishing click, or an unpatched system—can cascade into a massive breach. And if you're a business using an MSP, you need to ask tough questions about how they secure their own access. > "The attacker only needs to be right once; the defender needs to be right every time." That old saying feels especially relevant here. ### How to Protect Your Tenants So what can you do? Start with these practical steps: - **Enforce multi-factor authentication (MFA)** everywhere, especially on administrative accounts and backup platforms. - **Use unique, strong passwords** for every service. A password manager helps. - **Monitor for unusual sign-ins** and set up alerts for impossible travel or multiple failed attempts. - **Limit access** to only those who absolutely need it. Least privilege is your friend. - **Regularly audit third-party integrations** and revoke unused permissions. ### The Bigger Picture This incident isn't just about ConnectWise. It's a reminder that the supply chain is a favorite target for attackers. MSPs are gatekeepers, and compromising one MSP can unlock many businesses. That's why security researchers are urging MSPs to treat their own credentials with the same care they'd expect their clients to. We reached out to ConnectWise for comment but haven't heard back yet. In the meantime, if you're using ConnectWise Cloud Backup or any similar service, double-check your security posture. Rotate credentials, enable MFA, and keep an eye on your logs. It's better to be paranoid than breached.