ConnectWise Cloud Backup is off after breach: how to cover the gap

ConnectWise has shut off its Cloud Backup service, the Microsoft 365 backup product formerly sold as SkyKick, after attackers got hold of the credential its app uses to sign in to customer tenants. Its status page said early on October 17 that the shutdown would stop customer backups "until further notice." By that afternoon ConnectWise had revoked the certificates for the affected app connections, said the shared credentials no longer work and brought in an outside incident response firm. It has not given a date for backups to resume.

By 19:00 UTC on October 16, Huntress had confirmed that someone signed in without authorization to 162 tenants. The Hacker News puts the Huntress count at 173. Huntress also counted close to 1,000 Entra tenants where the attacker's address tried to sign in, and says over 300 of those succeeded. Because the attacker signed in as the app, multi-factor authentication never applied.

Companies whose provider backs up Microsoft 365 with this product now have two problems. The first is the breach itself. The second is a backup that has stopped, with no restart date, while the advice from security firms tracking the breach is to keep the app switched off.

What we know about the breach

Between 06:13 and 08:34 UTC on October 15, the Cloud Backup app collected Microsoft Graph tokens in customer tenants from one hosting-provider address, working through tenant IDs in sorted order, Huntress found. In roughly 50 tenants Huntress monitors, ConnectWise Cloud Management apps gave themselves directory roles, mostly Exchange Administrator. In one tenant, the Teams management app made itself Global Administrator and added new secrets, set to expire in 2028, to two other applications.

Microsoft Threat Intelligence described an active supply-chain attack, likely using permissions customers had already granted, including Directory.ReadWrite.All, BleepingComputer reported. Coalition says community reports describe email, SharePoint and Teams data being taken, and that ConnectWise has not confirmed them. Huntress saw no mail or file access in the one tenant log it reviewed in detail, but warns that directory reads through Graph leave no audit trail.

ConnectWise's first advisory, on October 16 at 1:47 pm ET, "recommends no partner actions," Blumira noted. Early the next morning, the status page told partners to check application sign-ins in their own tenants, and a later update said ConnectWise has no visibility into partner environments.

What happens to your backups

ConnectWise says the existing archive is not affected by the interruption. Its archives "remain encrypted and isolated," it says, and it has found no sign anyone touched them. New backups are a different matter. Disabling the app pauses them, and they stay paused until it is turned back on. Huntress says not to do that until ConnectWise confirms every credential has been reset.

Disable the app. Do not delete it. Huntress says deleting removes the consent, and the service then needs a fresh consent to work again. ConnectWise has not said whether restores from the existing archive work while the app is off, so ask your provider before you need one.

Until backups restart, Microsoft 365's own retention is the safety net. In Exchange Online, mail a user permanently deletes is kept in Recoverable Items for 14 days by default, and an admin can raise that to 30. At the default, mail permanently deleted on October 17, the day backups stopped, drops out of Recoverable Items after October 31. At 30 days it lasts until November 16. In SharePoint, deleted items stay in the recycle bins for 93 days, which for something deleted on October 17 runs to January 18, 2027.