A Microsoft 365 backup service needs permission to read everything it backs up: every mailbox, every OneDrive, every SharePoint site, every Teams chat. That is the point of it. In October, attackers stole the credentials that carry that permission, and used them to walk into customers' Microsoft 365 environments through the front door.
What happened
Cloud backup for Microsoft 365 works through an application registered with Microsoft and given broad permission, once, by each customer's administrator. After that the application signs in on its own, with no user and no password prompt, using a secret or certificate held by the backup provider. Whoever holds that secret holds the application's access to every tenant that trusted it.
That is what the attackers obtained. Microsoft says Storm-0940 "acquired control of the identities of multiple ConnectWise cloud applications" and used ARTEX to attempt sign-ins to more than 2,250 tenants, at one point more than 200 sign-ins in under four minutes. Where a sign-in worked, the automated tooling moved quickly: reading the directory, adding its own credentials to applications so it could return, changing roles and, in some cases, reaching privileged access within three hours.
The security firm Huntress, which monitors many small-business tenants, reported confirmed unauthorized sign-ins in 162 of its customers' tenants. It also found the backup company's own management apps granting themselves administrator roles, mostly Exchange Administrator, in nearly 50, and in one case Global Administrator. Microsoft's summary is that "the majority of the targeting wasn't successful," but that the group "achieved privileged cloud persistence at many organizations."
ConnectWise disabled the seven application identities and revoked their credentials on 17 October, which stopped the attack and also stopped every customer's backups. It has since built a new application, "ConnectWise Cloud Backup for M365," and began bringing partners onto it on 28 October. It says the encrypted backup archives were isolated and show no sign of compromise, and that there is no indication other ConnectWise products were affected. How the credentials were exposed remains under investigation.
Why this one matters
Businesses buy Microsoft 365 backup because they are worried about losing data. Very few think of the backup service as a way in. But a backup app is, by necessity, one of the most powerful identities in the tenant, it never signs in interactively, it is exempt from the multi-factor prompts staff see, and its credentials live with someone else.
This is the same pattern as the Railway breach earlier in the month. One provider holds the keys for thousands of customers, so stealing those keys once is worth more than breaking into any single customer. And as with Railway, the customers could not have prevented the theft. What they control is how much those keys can do, and whether anyone would notice them being used.
It is also the clearest example so far of what the June warning from the Five Eyes cyber agencies meant by AI shortening attack timelines. The sign-ins were automated at a rate no human operator would manage, and the move from first sign-in to administrator took hours. We covered what those warnings mean for a smaller business here.
What to actually do
Find out whether you use it. Ask your IT provider whether your Microsoft 365 is backed up by ConnectWise Cloud Backup or SkyKick. In the Microsoft Entra admin center, look under Enterprise applications for anything named SkyKick or ConnectWise. Match by application ID, not name, because older installations still carry SkyKick names.
If you do, make sure it is restored properly. Your provider needs to reset their ConnectWise password, set up multi-factor authentication, and re-authorize your tenant in the new app. Do not re-enable the old applications unless ConnectWise says to. Then confirm that new backups are actually completing; re-authorizing alone does not prove it. Expect a gap in backup history from mid-October.
Check your tenant for what the attackers might have left. Look in the Entra audit and sign-in logs from at least 1 October for credentials or certificates added to any application, new applications or owners, new role assignments, changes to Conditional Access, new users, password resets and new MFA methods. In Exchange, look for new forwarding rules and mailbox delegations. Preserve the evidence before removing anything. Log retention is only seven days on the free tier of Entra and 30 on paid tiers, so do this now.
Review every app with broad access to your tenant. Backup, email security, archiving, e-signature, CRM integrations: list them, check what permissions each one has, and remove the ones you no longer use. Each is a key someone else holds.
The summary
ConnectWise's customers did nothing wrong. They connected a backup service, as most well-run businesses do, and the provider's credentials were stolen. The restoration is under way and the archives appear intact.
The lasting lesson is about the apps you have trusted with your tenant. Each one is an identity with power and no password prompt, held by a company you depend on. Know which ones you have, give them no more access than they need, and watch what they do.
Sources
- Cloud Backup security advisory and updates — ConnectWise Trust Center
- ConnectWise Cloud Backup technical investigation and remediation guide — ConnectWise
- Storm-0940 uses ARTEX agentic AI and a ConnectWise supply chain compromise — Microsoft Threat Intelligence
- Hackers breach Microsoft 365 tenants via ConnectWise supply chain attack — BleepingComputer
- Stolen ConnectWise SkyKick credential exposed Microsoft 365 tenants — iTnews
- ConnectWise suspends cloud backup services as it probes hack — GovInfoSecurity
