ConnectWise Breach Let Attackers Into 173 Microsoft 365 Tenants With One Stolen App Credential

The scariest breaches are not the ones where someone picks your lock. They are the ones where someone finds the master key you lent to a trusted friend and walks through the front door. On October 15, 2026, unknown attackers did exactly that to Microsoft 365. According to security firm Huntress, a compromised application credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was used to obtain Microsoft Graph tokens and sign into 173 partner and customer tenants between 06:13 and 08:34 UTC, from a single rented hosting IP address. The attackers moved through tenant after tenant in sorted GUID order, a few seconds apart, which points to an automated script working from a prebuilt target list.

ConnectWise disclosed the unauthorized access on October 16 and shut down application access for its Cloud Backup partners and customers while it investigates. Microsoft is calling the campaign an active supply chain attack.

How one credential opened so many doors

ConnectWise Cloud Backup is a backup and recovery service built for managed service providers. To do its job, the app is granted broad standing permissions in every Microsoft 365 tenant where an MSP installed it: mailboxes, OneDrive, SharePoint, Teams chats, and directory data. In Microsoft Entra ID, the app is represented by a service principal, and the app itself holds a secret, much like a password.

That secret fell into hostile hands. Whoever held it could authenticate directly to Microsoft 365 as the application itself, not as any individual user. As Huntress researcher Jonathan Semon put it, "the app's credential is in hostile hands."

No phishing email was needed. No multifactor prompt stood in the way. The attacker simply presented the app's valid credential and inherited everything the app had already been granted. Because Microsoft 365 treats a service principal sign-in as legitimate when the credential checks out, standard identity defenses had nothing to object to.

What the attackers actually did

Todyl, which investigated sign-ins in the tenants it monitors, found the activity limited to signing in with the already-approved application. The attacker hit one tenant after another in rapid succession, which the company said explains the absence of follow-up actions in its telemetry. Todyl found no evidence that the attacker created accounts, added permissions, changed passwords, or established persistence through the backup app in those tenants.

But a deeper investigation found the campaign went further in at least one case. According to Huntress, in one partner tenant a separate ConnectWise application, Cloud Management for Teams, elevated itself to the Global Administrator role. From there, the actor added new client secrets to an MSP management application and to the Huntress security platform's own application, using a Python-based user agent. That is a classic persistence move: even after the original credential is revoked, backdoors planted in other apps would still let the attacker return.

There is also an earlier breadcrumb trail. Huntress observed the same IP address password-spraying four law firm tenants on October 13 and 14, although it detected no successful user sign-ins during that activity.

Why this attack is different

Most supply chain attacks compromise software code or an update pipeline. This one compromised an identity. The software was fine. The credential was not.

That matters because application identities in Microsoft 365 often hold permissions that no human user ever touches. A backup app that can read every mailbox and every SharePoint file is a legitimate design choice, but it is also a standing privilege with an enormous blast radius. And unlike a user account, a service principal cannot be protected by multifactor authentication. Its safety depends entirely on how well its secrets are guarded and how quickly anomalous sign-ins are noticed.

ConnectWise has said it has no indicators that partner backup data itself was compromised, and that existing cloud backup archives are unaffected. The extent of data access inside the breached tenants remains unclear. Huntress noted that in one detailed audit review it found no visible mail or file access, but directory reads through Microsoft Graph may not produce the same audit evidence.

What admins should do right now

If you are an MSP partner or manage any Microsoft 365 tenant, here is the checklist security researchers are recommending:

First, review service principal sign-in logs in Microsoft Entra for activity from the flagged IP address, 144.172.64.128. The known window is October 15 between 06:13 and 08:34 UTC, but researchers suggest preserving audit logs from October 13 onward.

Second, identify the ConnectWise Cloud Backup application in your tenant. The application ID is 506e08f9-6e9a-4da4-942b-a099a03644ae. Disable or remove the affected ConnectWise applications until ConnectWise completes remediation.

Third, and most importantly, review every other application in your tenant for credentials, secrets, or certificates added since October 13, along with role assignments. In at least one tenant the attacker planted new client secrets in other apps as a backdoor. Disabling the ConnectWise app alone does not remove those planted credentials.

Fourth, rotate app secrets on a schedule rather than waiting for a breach, restrict which roles can administer applications, and consider conditional access policies for workload identities, which is Microsoft's newer name for service principals.

The broader lesson is uncomfortable but simple: every third-party app your tenant approves is an identity you now share. Audit those identities like you audit your admins, because attackers have learned to do exactly that.

Frequently Asked Questions

What is a service principal in Microsoft 365?

A service principal is an application's identity in Microsoft Entra ID. When you consent to an app like ConnectWise Cloud Backup in your tenant, a service principal is created with the permissions you granted. The app authenticates with its own credential, so it can act without any user signing in.

Was my Microsoft 365 tenant affected by the ConnectWise breach?

Your tenant is exposed if the ConnectWise Cloud Backup application was installed and consented in it. Check Microsoft Entra sign-in logs for the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, especially around October 15, 2026, and look for sign-ins from the IP address 144.172.64.128.

Did ConnectWise say backup data was stolen?

ConnectWise has said it has no indicators that partner backup data was compromised and that existing cloud backup archives are not impacted by the service interruption. The company says the investigation is ongoing and the credential-exposure mechanism is still under review.