ConnectWise, Microsoft Incident Exposes M365 Accounts; Service Briefly Suspended

Key points

• Unknown actors accessed Microsoft 365 accounts through credential theft and application identity misuse.
• ConnectWise Cloud Backup, SkyKick, Cloud Management, SaaS Security and Microsoft 365 are in scope.
• A service was paused temporarily; the number of affected accounts was not disclosed.
• No CVE was assigned, and the incident is assessed as medium severity.

On 2026-10-19, details emerged about an intrusion involving ConnectWise and Microsoft in which unidentified attackers gained access to Microsoft 365 accounts. The activity combined stolen credentials, misuse of application identities and direct account intrusion, according to the available facts. A service was also taken offline for a short period as part of the response.

The event touches several connected offerings: ConnectWise Cloud Backup, SkyKick, Cloud Management, SaaS Security and Microsoft 365. The exact number of customers or accounts affected was not disclosed, so the practical scope remains unclear. The temporary suspension appears to have been a containment measure rather than a permanent outage, but organizations should verify their own service status and account activity.

This matters because identity-based intrusions against SaaS and backup management platforms can expose sensitive mailboxes, files and administrative workflows. Application identities are especially important to review: if attackers can abuse an app registration or service principal, ordinary password resets may not be enough. The absence of a CVE does not reduce the need to investigate, since this incident centers on credentials and identity abuse rather than a software vulnerability.

For K-12 and government teams, the priority is to confirm whether any Microsoft 365 accounts, backup jobs or SaaS management integrations were accessed unexpectedly. Review sign-in logs, consent grants, service principal changes and backup activity around the incident date. Because the affected population is unspecified, assume exposure is possible until logs show otherwise.

Watch for vendor updates from ConnectWise and Microsoft, and treat any new guidance on SkyKick or Cloud Backup integrations as actionable. The medium severity rating reflects limited public detail, not a low risk to identity controls. Organizations should use this event to tighten application governance and reduce standing privileges across Microsoft 365 and connected SaaS tools.

What to do now

1. Reset passwords and revoke active sessions for any Microsoft 365 accounts tied to ConnectWise, SkyKick or related integrations, then enforce multifactor authentication.
2. Audit app registrations, service principals and OAuth consent grants in Microsoft 365; remove unused applications and rotate secrets or certificates for remaining integrations.
3. Review ConnectWise Cloud Backup, SkyKick, Cloud Management and SaaS Security logs for unexpected access, configuration changes or backup activity around 2026-10-19.
4. Inspect Microsoft 365 audit logs for anomalous sign-ins, new application identities and privilege changes; alert on suspicious identity activity.
5. Reduce standing administrative roles and apply least privilege to accounts and applications that manage backups or SaaS services.
6. Confirm that any temporarily suspended service has been restored securely, and validate backup integrity before resuming normal operations.
7. Monitor vendor advisories from ConnectWise and Microsoft; since no CVE is assigned, focus on identity and credential controls rather than patch tracking.

Original source

Help Net Security