Microsoft 365 Breach: How a Supply Chain Attack Exposed Tenant Data

Michael Miller · 2026-10-17

When you hear about a supply chain attack, you might picture a complex hacking scene from a movie. But the reality is often simpler—and scarier. Recently, ConnectWise had to shut down access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers got their hands on application identities and compromised Microsoft 365 tenants. If you're an IT pro or a business owner relying on these tools, this should make you pause. Let's break down what happened and what it means for you. ### What Exactly Went Down? ConnectWise discovered that attackers had accessed application identities—these are like digital keys that allow apps to talk to each other. With those keys, the hackers could slip into Microsoft 365 tenants and potentially access sensitive data. In response, ConnectWise pulled the plug on its Cloud Backup service to contain the damage. This isn't just a minor hiccup. It's a reminder that even trusted vendors can become gateways for cybercriminals. And when you're managing multiple clients or your own business, a single breach can ripple out widely. ### Why Should You Care? If you use ConnectWise or similar management tools, your Microsoft 365 environment could be at risk. The attackers didn't just steal data—they compromised the very identities that keep your services running smoothly. Think of it like this: Imagine your office building's master key falls into the wrong hands. Suddenly, every office, every filing cabinet, every safe is vulnerable. That's essentially what happened here, but in the digital realm. ### The Bigger Picture: Supply Chain Vulnerabilities Supply chain attacks are on the rise because they're efficient. Instead of breaking into each target individually, hackers go after the common link—the software provider. Once they're in, they can fan out to dozens or hundreds of downstream customers. > "Supply chain attacks are the new frontier. They exploit trust, and trust is something we can't easily patch." — Anonymous security researcher This incident with ConnectWise is just the latest example. It follows a pattern we've seen with other major breaches, and it won't be the last. ### How to Protect Your Organization So, what can you do? Here are some practical steps: - **Audit your third-party tools**: Know exactly which applications have access to your Microsoft 365 environment. Revoke permissions that aren't absolutely necessary. - **Enable multi-factor authentication (MFA)**: Even if an attacker gets an application identity, MFA can add an extra layer of defense. - **Monitor for unusual activity**: Set up alerts for any strange login attempts or data access patterns. - **Have a backup plan**: If your cloud backup service goes down, you need a fallback. Consider a secondary backup solution that's independent of your primary provider. - **Stay informed**: Follow security advisories from vendors and industry news. Being aware is half the battle. ### What ConnectWise Is Doing ConnectWise hasn't just shut down the service and walked away. They're actively investigating and working to restore access securely. In the meantime, affected customers are left scrambling for alternatives. If you're a ConnectWise customer, check their official communications for updates. And don't wait—start reviewing your own security posture today. ### The Takeaway This breach is a wake-up call. In a world where we rely on interconnected services, security is only as strong as the weakest link. By staying vigilant and taking proactive measures, you can reduce your risk and protect your data. Remember, it's not about if an attack will happen, but when. Stay prepared.