TL;DR: ConnectWise has suspended Cloud Backup, formerly known as SkyKick, after what it calls “unauthorized access to application identities associated with ConnectWise Cloud Backup.” Scheduled backups aren’t running and restores are unavailable. ConnectWise has also taken SaaS Security and Cloud Management offline as a precaution, and has no restoration time yet. If you, or your IT provider, use these services with Microsoft 365, review your tenant now.

What happened

ConnectWise first published its advisory on Oct 16 at 17:47 UTC (Oct 17, 1:47 a.m. Manila time) and last updated it on Oct 18 at 01:00 UTC (9:00 a.m. Manila).

ConnectWise says it is investigating “unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick.” Those application identities are the apps the service uses to connect to Microsoft 365.

Microsoft Threat Intelligence posted on Oct 17 at 07:29 UTC (3:29 p.m. Manila) that it “is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens.”

According to ConnectWise:

  • At 07:00 UTC on Oct 17 (3:00 p.m. Manila), it disabled seven ConnectWise application identities. It says this “prevents new authentication through those connections; it does not reverse changes previously made inside a tenant.”
  • It revoked the certificates for the affected connections. “Previously issued access tokens may remain usable until they expire or are otherwise invalidated.”
  • Existing backup archives “remain encrypted, isolated, and preserved. We have no evidence that these archives have been accessed.”
  • It can’t see into customer tenants: Cloud Backup “does not provide the downstream security visibility needed for us to determine independently whether a particular partner or customer tenant experienced unauthorized activity.”
  • It says the service shutdowns “do not, by themselves, establish that a partner or customer environment was compromised.”

Who’s affected

These are cloud services, so there are no version numbers to check. ConnectWise names:

  • ConnectWise Cloud Backup (formerly SkyKick): suspended. Scheduled backups aren’t running, and access to affected archives and restores is unavailable.
  • SaaS Security and Cloud Management: taken offline as a precaution. Monitoring and alerting, and user and license management, are unavailable. ConnectWise says to contact Partner Care for changes you’d normally make there.

The seven application identities ConnectWise disabled are ConnectWise Cloud Backup and ConnectWise Cloud Management, plus Cloud Management apps for MS Teams, Exchange Online, MS Graph, Partner Center and SharePoint Online. The advisory lists each Application ID. Older installations may show SkyKick Cloud Manager names, so ConnectWise says to match on Application ID, not display name.

ConnectWise says partners should review their own Microsoft 365 tenant and each customer tenant they manage, “including environments with dormant SkyKick connections.”

What SMBs and MSPs should do now

If you’re an SMB: ask your IT provider whether they use ConnectWise Cloud Backup, SkyKick, SaaS Security or Cloud Management for your Microsoft 365, and whether they’ve reviewed your tenant. Your backups through this service aren’t running right now, so ask what covers you in the meantime.

If you’re an MSP or Microsoft 365 admin, ConnectWise’s advisory asks you to:

  1. Check the apps. In Microsoft Entra, find each listed Application ID under Enterprise applications and keep them disabled until ConnectWise gives restoration instructions. Don’t delete them first; ConnectWise says to preserve the configuration as evidence.
  2. Save the logs now. Export audit and sign-in records promptly. ConnectWise notes Entra normally keeps them for seven days on Free and 30 days on P1/P2, and “a license upgrade does not recover expired history.”
  3. Review sign-ins. Look from Oct 13, 2026 to now, and back to Oct 1 where records exist. Filter for the address ConnectWise published, 144.172.64.128, and for each listed Application ID, but don’t search only that address: ConnectWise says to review any unfamiliar addresses too.
  4. Review access and changes. Check application credentials and federation trusts, directory roles, owners, consent grants and recent policy changes.
  5. Check mail. Look for “unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access.”
  6. Follow other identities. Disabling the original apps “does not remove those separate access paths,” so investigate any other identity changed or used during suspicious activity.

ConnectWise says a successful sign-in alone doesn’t prove data was copied, and a clean search can’t rule out activity that wasn’t logged. Report suspicious activity to [email protected]. ConnectWise says it will keep updating its Trust Center, which is the place to check for restoration status.

Sources & method

Sources

Method. Last checked October 18, 2026. Every claim comes from ConnectWise’s advisory or Microsoft Threat Intelligence’s post. We did not use third-party counts of affected tenants. Manila times are converted from the UTC times in the sources. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.