ConnectWise Cloud Backup (SkyKick) Breach: What to Check If You're Affected

How the ConnectWise SkyKick Breach Exposed Microsoft 365 Tenants Across the MSP Supply Chain

Please note: Innovec does not use ConnectWise products or services.

Last week, attackers stole a credential from ConnectWise Cloud Backup and used it to access the Microsoft 365 data of the businesses it was meant to protect. If your IT provider uses ConnectWise Cloud Backup, formerly SkyKick, your Microsoft 365 environment may have been exposed.

Here’s what we know so far about the ConnectWise SkyKick breach, what we think made it possible and what you should be asking your provider now.

How the attack unfolded

On 15th October, attackers used a stolen credential belonging to ConnectWise Cloud Backup to sign in to Microsoft 365 environments managed by IT providers using the tool (BleepingComputer). The backup app had been given wide access to email, OneDrive, SharePoint, Teams and directory data, so whoever held its credential could reach all of that in every organisation where it was installed.

Our cyber security partner Huntress confirmed unauthorised sign-ins in at least 173 Microsoft 365 tenants. In some, the attackers gave themselves administrator rights and added credentials to other trusted apps so they could return later. ConnectWise has taken the service offline while it investigates, which means its customers’ backups have stopped running too.

Multi-factor authentication didn’t come into it. These were app sign-ins rather than staff logging in, so nobody was phished and no passwords were guessed. The attackers came in through a service the business had already approved.

Huntress contacted our Managing Director on Friday night as the attack came to light. We checked our systems and our customers’ environments that evening and found no sign of compromise.

How we think it was possible

ConnectWise hasn’t confirmed how the credential was taken, so this is our reading of the conditions behind the attack rather than a confirmed root cause.

Apps built to serve thousands of organisations often run on a single credential held by the vendor, so if it leaks, every customer is exposed at once. Backup tools also need broad permissions around the clock, which makes them a high-value target. In our experience, apps also keep their access long after anyone remembers installing them, and in this case one administrator reported an alert from a SkyKick app they hadn’t used in years. Huntress also notes that some directory reads in Microsoft 365 leave no audit trail, so a clean log doesn’t prove nothing was accessed.

What to ask your IT provider

When you outsource your IT, you also take on your provider’s suppliers. If your provider uses ConnectWise, or you aren’t sure, these are the questions we’d want answered this week.

Risk	Question to ask
ConnectWise or SkyKick apps in your tenant	Were they installed, and have they been disabled and checked?
Third-party apps with access to your data	Which apps can access our Microsoft 365, and do they still need it?
App sign-ins sit outside MFA	Is anyone monitoring app activity as well as user logins?
Backup provider offline	How would we recover without it?

How we protect our customers

Through our partnership with Huntress, our customers’ devices and Microsoft 365 accounts are monitored around the clock by a human-led security team. They look for the behaviour seen in this attack, including unusual sign-ins, accounts granting themselves new permissions and credentials appearing where they shouldn’t.

We keep our supplier list short because every additional tool means someone else holds a key to our customers’ data. We’re certified to Cyber Essentials Plus, so our own controls are independently tested, and we train our customers’ staff to recognise the attacks that technology can miss.

If you’d like us to check which apps can access your Microsoft 365 environment, book a security review with our team.