2026-10-30
ConnectWise Cloud Backup (formerly SkyKick) incident: AI-driven sign-in attempts against 2,250+ Microsoft 365 tenants, and what admins should check
On October 16, 2026, ConnectWise published an advisory saying there had been unauthorized access to application credentials associated with Cloud Backup (formerly SkyKick), its Microsoft 365 backup service for managed service providers (MSPs). It disabled seven application identities on October 17, suspended Cloud Backup, SaaS Security and Cloud Management, and reset all accounts and credentials in the affected environment on October 19. On October 21 Microsoft published research assessing that a state-aligned group was behind the compromise and had then used an open-source, multi-agent AI penetration-testing framework to attempt sign-ins to more than 2,250 tenants. Microsoft says most of the targeting was unsuccessful but that privileged cloud access was gained at many organizations, in some cases in under three hours. A security firm separately confirmed unauthorized sign-ins in 162 tenants as of October 16. ConnectWise says existing backup archives show no indication of compromise, but that this does not establish whether individual Microsoft 365 tenants were affected. This site's take: if you or your MSP ever installed these apps, check app credentials, directory roles and consents in your own tenant, and keep the apps disabled until ConnectWise says otherwise.