---
title: Stolen ConnectWise Credential Opened Microsoft 365 Tenants at Will
description: ConnectWise Cloud Backup’s API breach exposes hundreds in a supply-chain attack, bypassing MFA and affecting Microsoft 365 environments.
canonical_url: https://codekeeper.co/ticker/connectwise-cloud-backup-api-breach-exposes-customers
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Data breaches](https://codekeeper.co/ticker/tag/data-breaches)

# Stolen ConnectWise Credential Opened Microsoft 365 Tenants at Will

ConnectWise Cloud Backup’s API breach exposes hundreds in a supply-chain attack, bypassing MFA and affecting Microsoft 365 environments.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 21, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A compromised API secret for ConnectWise Cloud Backup, formerly SkyKick Backup, has left hundreds of customers exposed in an ongoing supply-chain attack. The credential belongs to a multi-tenant application, so whoever holds it can request access tokens in any tenant where the app is installed, with no action by the customer and no multi-factor prompt. Huntress dates the credential’s use to around October 14 and saw the first wave of attacks on Friday, October 16. Microsoft Threat Intelligence observed broad successful sign-ins from a malicious IP on October 15. By October 17, Huntress had seen sign-in activity across almost 1 000 Entra tenants, more than 300 of which appeared to succeed, and confirmed unauthorized sign-ins in 162 — with more likely beyond its own telemetry. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management that day. Disabling the app may not be enough. In tenants where Huntress saw post-compromise activity, the application’s account elevated its own privileges and added credentials to other applications, which would keep access alive after the original app was switched off. ConnectWise says it has no view into customer tenants and cannot tell whether any individual Microsoft 365 environment was accessed, so every affected tenant needs its own review. Huntress, ConnectWise, and Todyl all advise disabling ConnectWise Cloud Backup and ConnectWise Cloud Management – MS Teams in the Entra admin center even if the logs look clean. Existing backup archives remain encrypted and preserved. Source: [CyberScoop](https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fconnectwise-cloud-backup-api-breach-exposes-customers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Vulnerabilities Critical isolated-vm Flaw Lets Untrusted JavaScript Escape Sandbox Aug 24, 2026](https://codekeeper.co/ticker/node-js-sandbox-escape-vulnerability)

[Vulnerabilities Hackers Are Actively Exploiting a Critical WordPress Flaw — Update Now Sep 25, 2026](https://codekeeper.co/ticker/wordpress-vulnerability-cve-2026-87902)

[Cyberattacks Phishing Attack Bypasses Microsoft 365 MFA to Hijack a Finance Mailbox and Steal Payments Aug 24, 2026](https://codekeeper.co/ticker/phishing-attack-microsoft-365-bypass-mfa)

[![FBI arrests Canadian in Pennsylvania linked to ShinyHunters hack, part of efforts to dismantle the group after breaching FBI data.](https://codekeeper.co/hubfs/_sized/Generated%20Blog%20Post%20Images/fbi-arrests-canadian-in-shinyhunters-hack-800.png) Cyberattacks New Arrest in the Hunt for the FBI Jobs Site Hackers Oct 12, 2026](https://codekeeper.co/ticker/fbi-arrests-canadian-in-shinyhunters-hack)