ConnectWise Shuts Down Cloud Backup Access After Microsoft 365 Supply-Chain Breach

ConnectWise has disabled customer access to its Cloud Backup service (the product formerly known as SkyKick Cloud Backup) after attackers reportedly gained access to application identities and used them to compromise downstream Microsoft 365 tenants, according to BleepingComputer.

Why it matters for defenders

This is a supply-chain attack pattern: rather than targeting organizations directly, attackers appear to have leveraged compromised application identities belonging to a managed service provider (MSP) tool to pivot into customer Microsoft 365 environments. Any organization that used ConnectWise Cloud Backup/SkyKick Cloud Backup to protect Microsoft 365 data should treat this as a potential exposure, since the compromised identity likely had elevated, delegated access into tenant mail and data. The scope of affected tenants, the attackers' identity, and the full extent of data accessed have not been detailed in current reporting.

What to watch for / do now

• Review Microsoft 365 / Entra ID sign-in and audit logs for activity tied to the ConnectWise Cloud Backup / SkyKick application identity or service principal, especially unusual Graph API calls, mailbox access, or consent grants.
• Check for anomalous OAuth app permissions or admin consent events around third-party backup/MSP tooling in your tenant.
• If you use ConnectWise Cloud Backup, confirm with ConnectWise whether your tenant was affected, rotate any credentials or app secrets tied to the integration, and re-review the app's granted Graph/API permissions once access is restored.
• More broadly, inventory third-party apps with delegated or application permissions into Microsoft 365, and ensure conditional access and permission scopes follow least privilege for MSP tooling.

This is developing, net-new intelligence with limited technical detail disclosed so far — no CVE has been assigned and attribution is not yet established. We will continue to track this story. Read the original report at BleepingComputer.