Microsoft 365 Business Accounts Compromised in ConnectWise Supply Chain Breach
A sophisticated supply chain cyberattack has sent shockwaves through the managed IT services industry this week. On October 15, 2026, threat actors exploited a compromised credential belonging to ConnectWise Cloud Backup (formerly SkyKick Backup) to gain unauthorized access to 173 Microsoft 365 customer tenants. This information comes from cybersecurity firm Huntress and Microsoft Threat Intelligence.
The attackers used the stolen application credential to harvest Microsoft Graph API access tokens across customer environments. This action allowed them to inherit the broad permissions that clients had previously granted the backup app, including Directory.ReadWrite.All. Security researchers noted the sign-ins came from a suspicious hosting-provider IP address (144.172.64.128) between 06:13 and 08:34 UTC, with logins occurring seconds apart. This pattern is a clear indicator of automated, scripted activity.
Microsoft described the event as an “active supply chain attack,” noting that follow-on activity included Microsoft Graph API reconnaissance and attempts to add backdoor credentials to service principals. On October 17, ConnectWise suspended customer access to its Cloud Backup platform while the investigation remains ongoing. The company stated it found no evidence that backup archive data itself was compromised.
Security experts are urging all businesses using ConnectWise Cloud Backup to immediately audit application credentials and review sign-in logs for unauthorized access since October 13, 2026.