One Stolen Credential Just Opened 173 Microsoft 365 Accounts

Michael Miller · 2026-10-17

You know that uneasy feeling when you realize one weak link can undo an entire chain? That's exactly what's happening right now in the Microsoft 365 world. A single compromised credential tied to ConnectWise Cloud Backup—formerly known as SkyKick—has reportedly been used to sign into 173 different Microsoft 365 tenants. Yeah, you read that right. 173. Let me break down what that actually means for you, whether you're an MSP, an IT admin, or just someone who cares about keeping their business data safe. ### What Exactly Happened? Cybersecurity researchers are raising alarms about an active campaign. Unknown threat actors got their hands on a valid Microsoft 365 credential belonging to ConnectWise Cloud Backup. This isn't some sophisticated zero-day exploit or a brute-force attack. It's much simpler—and honestly, more concerning. The attackers just logged in. No alarms, no sirens. They used a legitimate credential to walk right through the front door of customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built specifically for managed service providers (MSPs). That means the customers affected are likely businesses that rely on MSPs to handle their IT. If your MSP uses this service, your data could be in the crosshairs. ### Why This Should Bother You Here's the thing: we tend to think of cyberattacks as these dramatic, high-tech operations. But often, it's just a stolen password. The hard truth is that credential-based attacks are skyrocketing because they work. They're quiet, they're fast, and they bypass a lot of traditional defenses. If you're an MSP, this is a five-alarm fire. Your clients trust you with their data. A breach like this doesn't just expose their information—it torpedoes your reputation. And if you're a business owner, you need to be asking hard questions about how your IT partner manages credentials and access. > "The most dangerous phrase in security isn't 'we've been hacked.' It's 'we didn't think it could happen to us.'" That quote might be a bit dramatic, but it's true. Complacency is the enemy here. ### How to Protect Yourself Right Now So what can you actually do? Here's a quick checklist: - **Enable multi-factor authentication (MFA) everywhere.** MFA won't stop every attack, but it makes stolen credentials far less useful. If your M365 tenant doesn't have MFA enforced, fix that today. - **Audit third-party access.** Review which applications and services have access to your Microsoft 365 environment. Remove anything you don't actively use. - **Monitor for unusual sign-ins.** Set up alerts for logins from new locations or devices. A sudden sign-in from halfway across the world should trigger a red flag. - **Use conditional access policies.** These let you block or challenge sign-ins based on risk factors like IP address or device compliance. - **Stay informed.** Follow updates from ConnectWise and Microsoft about this incident. If you're affected, you'll want to know sooner rather than later. ### The Bigger Picture This incident is a reminder that our digital ecosystems are deeply interconnected. One compromised credential in a backup service can ripple out to hundreds of businesses. It's not about pointing fingers—it's about recognizing that security is a shared responsibility. For antidetect browser professionals, this story hits close to home. You already know how critical it is to protect identities and manage multiple accounts securely. The same principles apply here: never underestimate the power of a single credential, and always assume you're a target. The researchers are still investigating the full scope of this campaign. But one thing is clear: if you haven't reviewed your access controls lately, now's the time. Don't wait for your own 173-tenant wake-up call.