ConnectWise Cloud Backup Attack: A Microsoft 365 Risk

Published Oct 28, 2026

A trusted backup connection became a route into Microsoft 365. The incident raises two questions for business owners: who can access your data, and can you recover when your backup provider is unavailable?

Why this matters even if you never bought ConnectWise

You pay a backup provider so a lost mailbox or deleted folder does not become a business emergency. To restore that data, the provider needs access to it.

That access creates another route into Microsoft 365. And if the provider is unavailable, your backup may not be usable when you need it.

Your managed service provider may have set up ConnectWise Cloud Backup without you ever dealing with ConnectWise directly.

What happened at ConnectWise

ConnectWise Cloud Backup, formerly SkyKick, is supplied through managed service providers. Your IT provider may use it behind the scenes to protect your business email and files.

ConnectWise says it discovered the incident on October 14, 2026, and found unauthorized access to application credentials associated with Cloud Backup. It suspended Cloud Backup and, as a precaution, its connected SaaS Security and Cloud Management services.

In its October 21 investigation, Microsoft attributed the attack to Storm-0940, a China state-aligned group. Microsoft says the attackers used compromised application credentials to enter customer Microsoft 365 environments through permissions those applications already held. An employee did not have to complete an interactive sign-in for that access to occur.

Microsoft reported attempted sign-ins to more than 2,250 customer environments. That is a measure of targeting, not a count of businesses with confirmed data theft. Microsoft says even successful authentication alone does not establish that customer data was accessed or copied.

Why “we have MFA” does not answer this question

Multifactor authentication helps protect people signing in. A backup application can have its own identity and credentials, allowing it to work in the background without an employee approving every operation.

Microsoft's authentication guidance explains that access rules scoped to users do not block calls made by these application identities, known as service principals.

Employee sign-in controls do not tell you which applications can reach your data, whether they still need that access, or who reviews their activity.

Huntress found a more serious example in the customer environments it investigated: a ConnectWise application assigned itself Global Administrator privileges and added credentials to other applications to maintain access.

If credentials were added to other applications, disabling the original connection will not remove them. A reset on the vendor's side also cannot establish that your Microsoft 365 environment is clean.

The attack moved quickly; response time matters.

Microsoft says the attackers used ARTEX, an AI-driven penetration-testing framework, to accelerate their activity. Across the broader campaign, some organizations went from initial targeting to privileged cloud access in less than three hours.

Huntress said its observations aligned with Microsoft's account, but it could not independently confirm the use of AI.

For your business, the practical questions are who sees an alert, who investigates it, and who has authority to act. If nobody checks until the next morning, an attacker may have hours to continue.

Huntress follow-up analysis

Preserved backups can still be unavailable

ConnectWise reported interruptions to scheduled backups, access to backup archives, and restores. Its October 27 update said preparations for phased partner restoration were complete but a required third-party validation was still pending. Partners were told to keep affected connections disabled until instructions applied to their service.

The same update said existing archives remained encrypted, isolated, and preserved, with no indication of compromise. Those statements concern the backup archives; they do not resolve whether individual customer Microsoft 365 environments were affected. Check the current vendor advisory for service availability.

Even if the backup files survive, you may not be able to retrieve them that day.

A dispatcher might need a deleted customer email to resolve a shipment dispute. A manufacturer might need an earlier version of a customer specification. If the provider is unavailable and there is no other recovery route, work could stall or a commitment could be missed. These are possible consequences, not reported outcomes of this incident.

Recovery planning needs to cover the restore process and the provider's availability—not just whether backup copies exist.

Ask your Microsoft 365 administrator these three questions

Start with the person who manages Microsoft 365 for your business, whether that is an employee or an outside provider.

Are we affected, including through an old integration? Ask them to check the ConnectWise and legacy SkyKick application IDs in the technical investigation guide, not just search by display name. Include dormant connections.
If anything is found, what did you review? Ask which dates the review covered and what the application sign-ins, credential or privilege changes, and mailbox or file activity showed. Have the responder note missing records, findings, and who will follow up. An authorized responder should preserve evidence and address suspicious activity. Do not delete the application as a first step or reconnect it before the vendor's instructions apply.
What can we restore today? Ask when the last successful backup ran, which restores are available, how much data may be missing, and how the business will handle essential records in the meantime. After an authorized restore, check that backup jobs are running again.

Use the same checks for your other connected apps

Even if this incident did not affect you, ask for a current list of applications that can access company email and files. Find out why each still needs that access and who reviews changes to its permissions or credentials. Ask when the last restore test happened and what the fallback is if the backup provider is unavailable.

You do not need to inspect technical logs yourself. Ask for a named person to explain what was checked and show you the evidence.

Vendor remote access security for small manufacturers

Frequently asked questions

What was the ConnectWise Cloud Backup attack?

ConnectWise says it discovered unauthorized access to application credentials associated with its Cloud Backup service, formerly SkyKick, on October 14, 2026. Microsoft attributed the activity to Storm-0940 and said the attackers used those credentials to enter customer Microsoft 365 environments through permissions the applications already held.

Does employee MFA protect against this kind of access?

Not by itself. MFA protects people signing in. Connected applications can use their own identities, known as service principals, and Microsoft's guidance notes that access rules scoped to users do not block calls made by those application identities.

Does a targeted sign-in mean our data was stolen?

No. Microsoft reported attempted sign-ins to more than 2,250 customer environments and cautions that even successful authentication does not, by itself, establish that data was accessed or copied. Your administrator needs to review the evidence for your own environment.

Should we delete the ConnectWise application from Microsoft 365?

Not as the first response. Have an authorized responder preserve evidence and address suspicious activity, keep affected connections disabled, and do not reconnect them ahead of formal vendor instructions. Deleting the original connection also does not remove credentials that may have been added to other applications.

Our backups are preserved. Does that mean we can recover?

Not necessarily. ConnectWise said its archives remained preserved, but backups and restores were interrupted. Ask what you can restore today, when the last successful backup ran, and how essential records will be handled while the recovery service is unavailable.

Verify the safeguards behind your recovery plan

If you want an independent check, the $1,995 Business Security Baseline reviews agreed safeguards and available evidence, including Microsoft 365 access protections, logging, and backup testing. The findings show what is working, what needs attention, and what could not be verified, with priorities for you and your IT provider.

The free Zero-Access Business Exposure Review is different. It checks public signals only, without passwords or internal access, so it cannot see which applications are connected to Microsoft 365 or whether your backups can be restored.

Sources

Reporting and guidance reviewed October 28, 2026. The latest ConnectWise incident update reviewed was dated October 27.

Review your Microsoft 365 safeguards and recovery evidence.

The $1,995 Business Security Baseline reviews agreed internal safeguards and available evidence, including Microsoft 365 access protections, logging, and backup testing. The free Zero-Access Business Exposure Review checks public signals only, without passwords or internal access.

See the Business Security Baseline Start the free exposure review