ConnectWise backup credential opened 173 Microsoft 365 tenants
Huntress says unknown attackers used a compromised ConnectWise Cloud Backup Microsoft 365 credential for unauthorized sign-ins across 173 partner and customer tenants. The service, formerly SkyKick, is an MSP backup tool with broad access to mail, files, Teams, and directory data in every tenant that has consented to it.
The attackers did not need each tenant user’s password. They authenticated as the backup app, asked Microsoft for Graph tokens, and inherited the app’s existing permissions, which lets whoever has the credential read the same data the backup service can reach.
That turns a vendor account loss into a cross-tenant exposure event. For organizations that rely on a third-party app for tenant-wide Microsoft 365 access, the blast radius follows the app’s trust, not a single mailbox or one customer tenant.
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.