ConnectWise confirmed unauthorized access to Cloud Backup (formerly SkyKick) application identities. The vendor credential was then used to authenticate into customer Microsoft 365 tenants.
What is confirmed
Huntress reported sign-in activity from one IP in nearly 1,000 Entra tenants, with more than 300 successful sign-ins. That does not prove data access. ConnectWise suspended Cloud Backup, revoked the affected certificates and reports no evidence its encrypted archives were accessed; it cannot determine what happened in customers’ live tenants.
Priority actions for administrators
- Review Entra service-principal sign-in logs for the Cloud Backup application ID and the reported source address
144.172.64[.]128. The usual user-sign-in view will miss this activity. - Temporarily disable affected ConnectWise service principals without deleting them. Follow ConnectWise guidance before re-enabling.
- Inspect audit logs for unexpected role grants, consent changes, or added app secrets and certificates across ConnectWise and other applications. Escalate suspicious changes and preserve logs.
- Check backup coverage, recovery points and interim restore options while Cloud Backup remains suspended.
Microsoft 365 administrators, MSPs and Cloud Backup/SkyKick customers should prioritize the review. Huntress found no confirmed mail or file access in one examined tenant; this does not rule out access elsewhere.
Sources: ConnectWise Trust Center (17 Oct) · Huntress investigation and guidance.