One Stolen Password Opened 173 Microsoft 365 Accounts

Emily Davis · 2026-10-17

Imagine a single key that unlocks not just one door, but 173 of them. That's essentially what happened when unknown attackers got their hands on a compromised Microsoft 365 credential tied to ConnectWise Cloud Backup, formerly known as SkyKick. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs). These providers manage IT for countless small and medium businesses, so when their credentials are compromised, the ripple effect can be massive. ### What Exactly Happened? According to cybersecurity researchers, the threat actors used the stolen credential to sign in to 173 different Microsoft 365 tenants. Each tenant represents a separate organization, meaning the attackers potentially had access to sensitive data across more than 170 companies. The campaign is still active, and researchers are urging MSPs and their clients to take immediate action. The attackers didn't need to exploit a software vulnerability—they simply logged in with valid credentials, which makes detection much harder. ### Why This Should Concern You If you're an MSP, this is a wake-up call. Your credentials are a goldmine for cybercriminals. They can use them to: - Access client emails, files, and calendars - Deploy ransomware or other malware - Steal sensitive business information - Maintain persistent access for months without being noticed Even if you're not an MSP, you might be a customer of one. That means your data could be at risk if your provider isn't vigilant. ### How to Protect Your Organization So, what can you do? Start with these steps: - **Enable multi-factor authentication (MFA)** everywhere. It's not foolproof, but it stops most credential-based attacks. - **Monitor for unusual sign-ins**. Look for logins from unfamiliar locations or at odd hours. - **Use least privilege**. Don't give accounts more access than they need. - **Regularly audit third-party access**. Know which vendors have keys to your kingdom. > "A single compromised credential can undo years of security investments. It's like leaving your front door wide open—no matter how strong the locks on the windows are." ### The Bigger Picture This incident highlights a growing trend: attackers are increasingly targeting MSPs because they offer a one-stop shop for accessing many businesses at once. It's a supply chain attack in the truest sense. As Emily Davis, Head of Digital Privacy and Antidetect Browser Solutions at Antidetectbrowsershub, puts it: "MSPs need to treat their own security with the same rigor they apply to their clients'. A breach at one provider can cascade into a disaster for hundreds of businesses." The investigation is ongoing, and more details may emerge. For now, if you work with an MSP, ask them what they're doing to secure their credentials. And if you are an MSP, double-check your security posture—before someone else does it for you.