ConnectWise Hack: How a Supply Chain Attack Exposed Microsoft 365

Robert Moore · 2026-10-17

You know that uneasy feeling when a company you trust gets hacked? That's exactly what happened with ConnectWise. They just shut down customer access to their Cloud Backup service—formerly SkyKick Cloud Backup—after hackers slipped in through application identities and compromised Microsoft 365 tenants. It's a supply chain attack, and it's a big deal. ### What exactly went down? ConnectWise provides IT tools for managed service providers (MSPs). Those MSPs manage Microsoft 365 for countless businesses. The attackers didn't go after ConnectWise directly—they targeted the application identities used by the backup service. Once inside, they could access data across multiple tenants. That's the scary part: one weak link can expose many. ### Why should you care? If you're an MSP or a business using ConnectWise's backup, your data might be at risk. Even if you're not, this is a wake-up call about supply chain security. Attackers love third-party services because they often have broad access and less scrutiny. ### What's the impact? ConnectWise has cut off access to the backup service while they investigate. That means customers can't back up or restore data right now. It's a mess. And it raises questions about how secure these integrated services really are. ### How to protect yourself - **Review third-party access:** Regularly audit which apps and services have access to your Microsoft 365 tenants. Remove anything unnecessary. - **Enable multi-factor authentication (MFA):** Even if a service is compromised, MFA can add a layer of protection. - **Monitor for unusual activity:** Set up alerts for suspicious logins or data access patterns. - **Have a backup plan:** Don't rely solely on one backup service. Use multiple methods, including local backups. - **Stay informed:** Follow security advisories from vendors and industry news. > "Supply chain attacks are like a wolf in sheep's clothing—they come through a trusted door." – Robert Moore ### The bigger picture This isn't the first supply chain attack, and it won't be the last. As businesses rely more on interconnected services, the risk grows. It's crucial to vet your vendors and have incident response plans in place. ### What's next? ConnectWise is working on a fix, but the damage may already be done for some. If you're affected, contact their support and monitor your accounts closely. And for everyone else, take this as a reminder: security is a chain, and it's only as strong as its weakest link. Stay safe out there.