Security · October 20, 2026
Supply chain attack via ConnectWise Cloud Backup affects numerous companies
A supply chain attack via ConnectWise Cloud Backup, formerly known as SkyKick, has impacted numerous companies and other organizations, according to cybersecurity company Huntress. Microsoft has also issued a warning about the attack. ConnectWise has disabled access to the Cloud Backup application, which affects the backup services that customers use.
ConnectWise Cloud Backup is a backup and recovery service that allows managed service providers (MSPs) to protect their customers' Microsoft 365 and Google Workspace data. The application has broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data of each environment where the application is installed.
Attackers have compromised the OAuth app of ConnectWise Cloud Backup to steal access tokens from customers and gain access to their environments, according to Microsoft. With these tokens, the attackers can read mailboxes, files, and directory data, just as the backup software can. Huntress reports that the environments of more than 170 organizations have been hacked in this manner.
Microsoft states that the attackers add credentials for the service principal to the hacked environments to maintain access. Organizations are being urged to check the logins of the service principal. Huntress asserts that the attacker also compromised the M365 applications of ConnectWise Cloud Management for Exchange Online, MS Teams, and SharePoint online.