One Vendor Credential. 173 Companies Breached. What the ConnectWise Attack Means for Your Business.

Last week, a single compromised credential belonging to a cloud backup vendor gave attackers read access to email, files, SharePoint data, and Teams conversations across 173 separate companies - without those companies doing anything wrong. No phishing. No employee mistake. No vulnerability in your systems. Just a vendor's credential, compromised once, weaponized everywhere.

This is the story of the ConnectWise Cloud Backup breach. And if your organization uses any cloud backup service, managed IT provider, or SaaS tool with access to your Microsoft 365 environment, it's a story you need to understand.

What Happened

On October 15, 2026, cybersecurity firm Huntress detected that an unknown threat actor had obtained the application credential for ConnectWise Cloud Backup - formerly known as SkyKick Backup - and was using it to authenticate into customer Microsoft 365 tenants.

ConnectWise Cloud Backup is used by managed service providers (MSPs) to back up their clients' Microsoft 365 data. To do its job, the application is granted broad permission to access mailboxes, OneDrive, SharePoint, Teams, and directory data across every tenant where it's installed. That's appropriate for a backup tool. It's also exactly what an attacker wants.

The attacker didn't need to hack 173 companies individually. They just needed one credential - the shared application secret belonging to ConnectWise Cloud Backup - and they had a skeleton key to every organization that had consented to the app.

Researchers at Huntress watched the attacker move through tenants in alphabetical order, a few seconds apart, working from an automated script. In less than two and a half hours, they had touched over 173 customer environments.

In at least one tenant, the attacker didn't stop at reading data. They assigned the application Global Administrator privileges, modified two other trusted applications in the environment - including an MSP management tool and a security platform - and added their own credentials to those applications as well. Those applications are often installed across dozens of additional customer tenants. The blast radius kept growing.

Microsoft confirmed the incident, tracking the activity and noting that the threat actor abused permissions that customers had previously granted to the application - permissions that included Directory.ReadWrite.All.

ConnectWise shut down the Cloud Backup service entirely while remediation is ongoing. The service remains unavailable.

Why This Matters for Your Business

Here's the uncomfortable truth this incident surfaces: your security posture is only as strong as the vendors you've given access to.

Every time you install a cloud backup tool, a managed service platform, a security monitoring application, or a productivity integration, you're extending trust. You're saying: this application can read my email, access my files, see my user directory. That trust is often appropriate - those tools need access to do their job. But when a vendor's credential is compromised, that trust becomes a liability.

This isn't a new class of attack. We've seen it with SolarWinds in 2020, with Kaseya in 2021, with Brevo's Cloudflare API key compromise earlier this year. The pattern is consistent: attackers target vendors with broad access to many organizations simultaneously. One compromise, mass impact.

What's changing is the scale and speed. The ConnectWise attacker moved through 173 tenants in about 150 minutes using an automated script. There was no slow, methodical intrusion to detect. By the time most security teams would notice unusual activity, the reconnaissance was already complete.

And critically: some of that access - particularly directory reads through Microsoft Graph - leaves no audit trail. Organizations may never know exactly what was accessed.

Three Questions Every Business Leader Should Ask Today

You don't need to be a cybersecurity expert to take the right next steps. But you do need to ask the right questions of your IT team or managed service provider.

First: What applications have broad permissions in your Microsoft 365 environment - and who manages each one?

In the Entra Admin Center, under Applications → Enterprise Applications, you can see every third-party app that has been granted permissions in your tenant. Most organizations don't review this list regularly. Many don't review it at all. Each of those entries is a trust relationship. Each trust relationship is a potential attack surface.

Ask your IT team to pull that list. For each application with mailbox, OneDrive, SharePoint, or directory permissions, ask: who owns this, is it still needed, and what would happen if the vendor's credential were compromised?

Second: If a backup or management vendor's credential were compromised today, how quickly would you know?

In this incident, the attacker was in and out of 173 tenants in 150 minutes. Huntress detected it - but only because they had service principal sign-in monitoring in place and were watching for anomalous authentication patterns.

The default Microsoft 365 audit logs don't show service principal sign-ins on the standard User sign-ins tab. You have to know to look at the Service Principal sign-ins tab, filter by the specific application ID, and have logging enabled for Microsoft Graph activity. Most organizations don't have that visibility configured.

If you use a managed service provider, ask them: are you monitoring service principal authentication in our tenant? What's your detection and notification SLA for anomalous third-party app activity?

Third: What happens if your backup vendor goes offline entirely?

ConnectWise shut down Cloud Backup entirely while it investigates and remediates. That means customers currently have no active backup running for their Microsoft 365 data. If a ransomware attack or data corruption event hit one of those organizations today, their recovery options just became significantly more limited.

This raises a broader resilience question: do you have a secondary backup strategy, or are you dependent on a single vendor for your recovery capability? The IDCF Cloud incident we covered earlier this month - where 495 organizations lost access simultaneously when a single provider was attacked - illustrated the same principle. Cloud concentration risk is real, and it doesn't require a direct attack on your own systems.

The Takeaway

The ConnectWise breach isn't a story about a flaw in your infrastructure. There was no vulnerability to patch, no employee to retrain, no misconfiguration to fix. It's a story about the structural risk of trust chains - and the fact that most organizations have almost no visibility into the third-party applications that have broad access to their most sensitive business data.

The attackers didn't need to be sophisticated. They needed one credential, one script, and 150 minutes. Your security program needs to account for what happens when a vendor you trust is the one that gets compromised.

At TrustPoint Cyber, we help organizations map and govern their third-party application access - so that when a vendor is compromised, you know immediately, you know what was at risk, and you have a plan to respond. That conversation starts with a single question: do you actually know what's installed in your Microsoft 365 environment?

If the answer is 'I'm not sure,' let's talk.