One Stolen Login, 173 Microsoft 365 Tenants Breached

Michael Miller · 2026-10-17

You know that uneasy feeling when you realize one weak link can unravel everything? That's exactly what's happening in a live cyberattack right now. Unknown hackers got their hands on a single compromised credential for ConnectWise Cloud Backup (formerly SkyKick), and they've been using it to waltz into Microsoft 365 environments. So far, 173 tenants have been accessed without permission. If you're an MSP or a business relying on cloud backups, this one hits close to home. ### What Exactly Went Down ConnectWise Cloud Backup is a service built for managed service providers (MSPs) to back up and restore client data in Microsoft 365. It's the kind of tool that holds keys to many doors. When attackers stole one credential, they didn't just get into one account—they potentially unlocked a whole neighborhood. Researchers say the threat actors are actively logging into customers' M365 environments. That means emails, files, Teams chats, SharePoint sites—anything stored in those tenants could be exposed. And because MSPs often manage dozens or hundreds of clients, the blast radius is huge. > "This isn't just a breach; it's a trust breach. MSPs are the backbone of small business IT, and when their tools get compromised, everyone downstream feels it." ### Why This Matters for Antidetect Browser Users If you're in the antidetect browser space, you already know how fragile digital identities can be. Attackers love to hide behind multiple profiles and spoofed fingerprints to avoid detection. But here's the flip side: the same techniques that protect privacy can also be abused by criminals. That's why securing credentials and monitoring access is non-negotiable. For professionals managing multiple online identities—whether for legitimate marketing, e-commerce, or security research—this incident is a wake-up call. One leaked password can bring down an entire operation. So ask yourself: - Are you using unique, strong passwords for every service? - Do you have multi-factor authentication (MFA) enabled everywhere? - Are you monitoring for unusual login activity? If you answered no to any of these, you're leaving the door open. ### How to Protect Your Tenants First, check if your organization uses ConnectWise Cloud Backup. If so, rotate credentials immediately and enable MFA if it's not already on. Second, review access logs for any suspicious sign-ins. Look for logins from unfamiliar locations or at odd hours. Third, consider adopting an antidetect browser for your team's daily work. Wait, that might sound counterintuitive—but here's the thing: antidetect browsers aren't just for hiding; they're for segregating. By isolating each client's sessions in separate browser profiles with unique fingerprints, you reduce the risk of cross-contamination. If one profile gets compromised, the others stay safe. Finally, educate your clients. Many small businesses trust their MSP blindly. A quick email explaining the situation and the steps you're taking can go a long way in maintaining trust. ### The Bottom Line This ConnectWise incident is a stark reminder that cybersecurity is a chain—and it's only as strong as its weakest link. Whether you're an MSP, a privacy advocate, or just someone who values their digital life, take action today. Rotate those credentials, turn on MFA, and think about how you're managing multiple identities. Because in a world where one stolen login can open 173 doors, you can't afford to be careless.