The Backup App You Trusted Just Became the Attacker's Login

Here is a security story with no phishing email, no stolen password, and no employee who clicked the wrong link. Last week, attackers got hold of a credential belonging to a vendor's Microsoft 365 backup application and used it to sign in to customer environments as the application itself. No password prompt. No multi-factor authentication challenge. The door opened because the customer had already handed the vendor a key.

The vendor is ConnectWise, and the product is Cloud Backup, formerly known as SkyKick Backup. It is the kind of tool that quietly protects a company's email and files, and that most executives have never heard of by name.

What happened

According to the security firm Huntress, which investigated the activity, the unauthorized sign-ins began on October 15, 2026, when the Cloud Backup app authenticated from a single internet address and received access tokens in customer Microsoft 365 environments. Microsoft publicly described it as an "active supply chain attack." ConnectWise confirmed unauthorized access to application identities and shut off Cloud Backup access, saying its investigation and remediation were ongoing.

The numbers are still moving. Early reporting, including Huntress's, put confirmed unauthorized sign-ins at 173 partner and customer tenants. A later Huntress update said nearly 1,000 tenants showed sign-in attempts from the same address, with more than 300 succeeding. Those figures haven't been reconciled publicly, so treat any single number with caution. ConnectWise has said it found no evidence that partner backup data was compromised, and Huntress has not confirmed data theft. But Huntress also noted that some directory lookups leave no audit trail, so "nothing visible was taken" is not the same as "nothing was taken."

Huntress also reported something more troubling: in at least one customer environment, a second ConnectWise application gave itself top-level administrator rights and then added new credentials to other trusted apps, which would let an intruder come back later.

Why this is a board-level story

Your security stops where your vendor's begins. Every control your team bought, from strong passwords to multi-factor authentication, protects people logging in. This attack never touched a person. It used an application identity, the digital equivalent of a master key a vendor holds to your building. When someone steals the vendor's copy, your locks work perfectly and are completely irrelevant.

The permission was yours to give, and probably yours to forget. Backup tools need broad access to do their job: read everything, so they can copy everything. Someone approved that years ago. Dormant installs matter too. A tool you stopped paying attention to can still hold the keys.

Compliance won't catch this. This is the compliance-versus-security gap I write about in Cyber Risk Is Business Risk. A vendor questionnaire asks whether the vendor has MFA and a security policy. It rarely asks, "How do you protect the secrets your software uses to enter our systems, and can we see what that software is doing in our environment?" A passed audit is not a protected company.

Apply the Three Questions

The book's framework asks three things of any risk: What are we protecting? How would we know if it failed? What would it cost us if it did?

What are we protecting? Our email and files, yes — and the access we've granted to every outside application connected to them. Most companies cannot list those applications.

How would we know? This incident is a good test. Reporting on the incident says the activity doesn't appear in the ordinary user sign-in view. It shows up under a separate service-account view that many teams never open. If your team has never looked there, you would not have seen this.

What would it cost us? Even in the best case, companies that rely on this product have backups paused while the vendor investigates. No restoration date has been public. Ask what your recovery plan looks like when the tool protecting your data is itself the problem.

What to ask your CISO this week

1. Do we use ConnectWise Cloud Backup, SkyKick, or Cloud Management apps, directly or through an IT provider? If so, has anyone checked them against the indicators Huntress and Microsoft published?
2. Can you show me every third-party application connected to our Microsoft 365 environment, what permissions each holds, and who approved it? If this takes more than a day to answer, that is itself the finding.
3. Who reviews service-account and application sign-ins, and how often? Make sure the answer isn't "no one."
4. Have any new credentials appeared on our applications since October 13? Both Huntress and Microsoft recommend checking.
5. If a backup vendor went dark tomorrow, how long could we operate, and have we ever tested a restore?

A practical note for technical staff: Huntress advises disabling, not deleting, the affected apps, since deletion can remove consent and complicate recovery, and keeping them off until ConnectWise confirms its credentials are reset.

The bottom line

Boards often ask, "Are our vendors secure?" The better question is, "What can our vendors do inside our environment, and who is watching them do it?" Directors who accept a clean questionnaire as the answer are accepting a risk they haven't measured. And when leadership is later asked what it knew and when, "we trusted the vendor" is a poor defense.

Put third-party access on this month's agenda. Not next quarter's.