Microsoft 365 Breach: How a Backup Tool Became a Backdoor

Michael Miller · 2026-10-17

When was the last time you checked who has access to your Microsoft 365 tenant? If you're like most IT pros, it's probably been a while. And that's exactly what attackers are counting on. ConnectWise recently slammed the brakes on its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers slipped in through application identities and compromised Microsoft 365 tenants. If that sounds like a plot twist from a cyber thriller, well, welcome to supply-chain security in 2025. ### What Actually Happened? ConnectWise didn't wake up one morning and decide to inconvenience its customers. They pulled the plug because attackers had found a way to abuse the backup service's application identities—the digital keys that allow the service to access your Microsoft 365 data. Once inside, those identities gave hackers a foothold in customer tenants. Think of it like a trusted employee who has a master key to every office in the building. If that employee gets compromised, suddenly every door is open. The service is now offline while ConnectWise investigates and remediates. But the damage might already be done for some organizations. ### Why This Should Scare You (Just a Little) Supply-chain attacks are nasty because they exploit trust. You vet your vendors, you sign contracts, you assume they've got security locked down. But when a vendor's tool has deep access to your environment, a breach on their end becomes a breach on yours. And Microsoft 365 tenants are prime targets. Email, files, calendars, Teams chats—it's all there. A compromised tenant can lead to data theft, business email compromise, and lateral movement into other systems. ### What You Can Do Right Now You don't have to wait for ConnectWise's next update to take action. Here's a quick checklist: - **Audit application identities:** Review every app with access to your Microsoft 365 tenant. Remove anything you don't recognize or no longer use. - **Enable conditional access:** Set policies that require multi-factor authentication for app access, especially for backup and admin tools. - **Monitor for unusual activity:** Look for spikes in mailbox access, file downloads, or new app registrations. - **Have a backup plan (literally):** If your backup service goes down, you need a fallback. Don't let a single vendor be your only safety net. ### The Bigger Picture This isn't the first supply-chain attack, and it won't be the last. The lesson? Trust is good, but verification is better. Whether you're using ConnectWise, SkyKick, or any other tool with deep tenant access, make sure you know exactly what it can do—and what happens if it's compromised. As one security researcher put it: "The weakest link in your security chain is often the one you didn't even know was there." Stay safe out there. And maybe schedule that tenant audit you've been putting off.