Hackers Just Slipped Into Microsoft 365 Through a Backup Tool

Emily Davis · 2026-10-17

ConnectWise just pulled the plug on customer access to its Cloud Backup service — the one formerly known as SkyKick Cloud Backup — and the reason is unsettling. Hackers got their hands on application identities, and from there, they walked straight into Microsoft 365 tenants. If you run a business that leans on third-party backup tools, this one deserves your attention. ### What Actually Happened Here's the short version: attackers didn't break down the front door of Microsoft 365. They went through a trusted partner instead. ConnectWise's Cloud Backup service holds application credentials that let it talk to your Microsoft 365 environment — reading mailboxes, backing up files, that sort of thing. Once those identities were compromised, the attackers had a key that opened a lot of doors. ConnectWise responded by cutting off customer access to the service. That's a serious move. It means some businesses temporarily lost their backup lifeline while the company scrambles to contain the damage. ### Why Supply-Chain Attacks Keep Working Think of it like this: you can deadbolt your own front door, but if the locksmith who made your key gets robbed, you've got a problem. Supply-chain attacks exploit exactly that gap. You trust a vendor, the vendor gets compromised, and suddenly your security posture depends on someone else's. This pattern isn't new. It keeps happening because third-party tools need deep access to do their jobs. Backup services, monitoring platforms, and management tools all hold privileged credentials. That's the trade-off nobody loves to talk about. ### What You Should Do Right Now If your organization uses ConnectWise Cloud Backup or any similar third-party backup solution for Microsoft 365, here's a practical checklist: - Check whether your tenant was affected and follow ConnectWise's official guidance closely. - Rotate application credentials and review which apps have consented access to your Microsoft 365 environment. - Audit enterprise applications in your admin center — remove anything you don't recognize or no longer use. - Enable multi-factor authentication everywhere, especially on admin accounts. - Keep an independent, offline backup of critical data so one vendor outage doesn't leave you exposed. ### The Bigger Lesson for Privacy-Minded Teams Every connected service is a trust decision. The more apps you authorize, the wider your attack surface gets. That doesn't mean avoiding tools altogether — it means knowing exactly what has access to your data and why. > "A compromised vendor isn't just their problem. It becomes yours the moment their credentials touch your environment." For teams already thinking hard about digital privacy and account isolation, this incident reinforces a simple principle: minimize privileged access, verify vendors, and never assume a trusted name means a safe connection. Attackers count on that assumption — and lately, it's been paying off for them. ### Wrapping Up The ConnectWise situation is still developing, but the takeaway is clear. Supply-chain attacks are efficient because they borrow trust you've already handed out. Review your third-party integrations this week, not someday. Your Microsoft 365 tenant — and everyone in it — will thank you.