On October 15, 2026, attackers used a stolen credential belonging to ConnectWise Cloud Backup for Microsoft 365 (formerly sold as SkyKick Cloud Backup) to sign in to the Microsoft 365 environments of businesses that use the service. Security researchers at Huntress have confirmed unauthorized access in more than 170 customer tenants so far, and Microsoft has called it an active supply chain attack. ConnectWise acknowledged the incident on October 16 and says its investigation is ongoing.
Many IT providers use this product to back up their clients’ email, OneDrive, SharePoint, and Teams data. If your provider is one of them, your company’s Microsoft 365 environment may have been exposed even though no one at your business did anything wrong.
Geek Girls IT does not use ConnectWise Cloud Backup or SkyKick for our clients’ Microsoft 365 backups, so our backup service is not part of this incident.
How the Attackers Got In
Backup tools need broad access to do their job. To copy your data, the backup app is given permission to read mailboxes, files, Teams conversations, and your user directory. The attackers didn’t need a password or a 2FA code because they signed in as the trusted backup app itself.
Reports from the IT provider community describe attackers pulling email, SharePoint, and Teams data out of affected tenants. In one case, the attackers also gave themselves full admin rights, which could let them get back in later.
The risk also applies to any tenant where the product was ever installed, including businesses that stopped using it years ago. The app’s connection to your tenant can stay in place long after the subscription ends.
Questions to Ask Your IT Provider
Ask your IT provider for direct answers to these questions:
- Do you use ConnectWise Cloud Backup or SkyKick for our Microsoft 365 backup, or have you ever used it?
- If so, have you disabled the app in our tenant?
- Have you reviewed our sign-in and audit logs for suspicious activity since October 13?
- Have you checked our tenant for unexpected administrators or new app credentials?
- Is our data still being backed up while the app is disabled?
If your provider isn’t sure of the answers, insist that they look into it and follow up with you.
If Your Provider Used This Product
Your provider should disable the app right away. They should also review every app with access to your tenant, remove any that aren’t needed, look for new admin accounts or credentials, and determine whether any data left your environment. If sensitive client or employee information may have been accessed, you should contact your cyber insurance carrier. You may also want to speak with an attorney about your responsibilities and obligations.
Get a Second Opinion
If you aren’t sure what backup service you use, or you would like an independent review of the third-party apps connected to your Microsoft 365 tenant, contact Geek Girls IT. We’ll check your environment, tell you what we find, and help you close any security gaps.
