ConnectWise Breach: One Hijacked App Hit 170+ Microsoft 365 Tenants

Nobody at the affected companies typed a wrong password or clicked a dodgy link. The break-in happened one level up, inside a backup tool their IT provider had quietly connected to their Microsoft 365 account years ago, with permissions almost nobody had thought to review since.

What actually happened

ConnectWise Cloud Backup — sold for years under the name SkyKick before the rebrand — is a product that managed service providers (MSPs, the outside IT companies small and mid-size businesses hire instead of running their own in-house IT team) use to back up client mailboxes and files on Microsoft 365. Security researchers at Huntress first noticed something odd on October 15: sign-ins to customer Microsoft 365 accounts coming from the backup app's own identity, not from any real employee.

That matters because of how these integrations work. Instead of logging in as a person, an app like this connects using a machine identity — essentially a standing set of credentials that Microsoft 365 trusts automatically, carrying whatever permissions were granted when it was first set up. Compromise that one identity, and you inherit its access across every customer it's connected to, in one move. By October 17, Huntress had confirmed 173 unauthorized sign-ins across partner and customer tenants, and said its wider telemetry showed sign-in attempts against nearly 1,000 Microsoft Entra ID tenants (Entra ID is Microsoft's identity system that manages who and what is allowed to log into 365 and other cloud services), with more than 300 actually succeeding.

ConnectWise has since cut off access for the Cloud Backup app entirely while it investigates, and says it's found no evidence that backup data stored on its own side was touched. It hasn't said how the credential was stolen in the first place. Researchers who've looked at individual affected tenants, including Todyl, say they've so far confirmed sign-ins but not actual mail or file access — though that picture could still change as more organizations check their logs.

Why a single login went this far

This is a textbook supply chain attack: rather than breaking into hundreds of companies one by one, an attacker goes after the one vendor that already has a trusted connection into all of them. Breach the vendor's app identity once, and the access fans out automatically.

It's the same underlying problem Code24 covered just a few days ago, when a single stolen login at Meta exposed data on roughly 1,500 people — except here the blast radius isn't one company's employees, it's every business that trusted a shared backup tool to sit quietly inside their inbox.

A backup tool is supposed to be insurance against disaster, not a second front door into every account it's meant to protect.

What this means for Indian businesses

India's MSP sector runs on exactly this kind of bundling. A huge number of small and mid-size Indian businesses don't manage Microsoft 365 themselves at all — they hand it off to a local IT vendor who sets up email, backup, and security tools as one package and rarely gets asked to explain what each piece can actually access. Many of those bundles lean on the same category of international RMM and backup platforms this incident involves, which means an Indian company could be exposed here without anyone in the building knowing a ConnectWise product is even in the picture.

There's a compliance angle too, and it's not optional. Under India's Digital Personal Data Protection (DPDP) Act, the Indian business is the data fiduciary — the party legally responsible for personal data — even when the actual intrusion happens inside a foreign vendor's systems. CERT-In's rules already require certain incidents to be reported within six hours of detection. "Our vendor got breached" doesn't pause that clock, and it won't satisfy a regulator asking why customer data wasn't protected.

A few things worth doing this week if your business or your IT provider touches Microsoft 365:

• Ask your MSP directly whether they use ConnectWise Cloud Backup or SkyKick, and whether access has been disabled or re-verified.
• In the Microsoft 365 admin center, check Entra ID sign-in logs for activity from unfamiliar app registrations or IP addresses in mid-October.
• Question any third-party app with broad "read all mail" or "read all files" permissions — most integrations don't need that much access to do their job.
• Treat a vendor's breach disclosure as the start of your own notification obligations under DPDP, not something to wait out quietly.

The bigger picture

What's striking here isn't that an attacker found a clever bug — it's that they didn't need one. They found the one app that thousands of companies had already decided to trust and let inside their inbox, years ago, without a second thought. As more of India's SMB sector outsources its IT stack to MSPs for cost and convenience, the actual security perimeter of a small business increasingly lives inside a vendor's app permissions, somewhere nobody in the building ever looks. This incident is a fairly cheap reminder to go look, before a regulator or a customer makes you.