ConnectWise CTO On Cloud Backup Cyberattack, M365 Update And Helping Thousands Of Partners - CRN

IT management software company ConnectWise shut down several of its services this weekend after Microsoft and other cybersecurity companies warned of a supply chain attack impacting its cloud backup system.  ConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday.   Incident responders at cybersecurity firm Huntress said a credential belonging to ConnectWise Cloud Backup was compromised and used to gain access to the customers’ Microsoft 365 environment.  Microsoft confirmed in its own statement that threat actors “likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory. ReadWrite. All.”  ConnectWise Cloud Backup is a cloud-based backup and recovery service designed to help protect data in Microsoft 365 and Google Workspace. The tool needs broad access to mailboxes, OneDrive, SharePoint, Teams and other data, according to Huntress.

Managed service providers said an attacker used compromised credentials to gain access to tenants. ConnectWise headquarters in Tampa, Florida. The company suspended service to its Cloud Backup service after a supply chain attack using compromised credentials.

Executive SummaryOn October 15, 2026, unauthorized access to application identities within the ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) environment enabled attackers to compromise at least 162 Microsoft 365 tenants. The breach was executed via a supply-chain attack, leveraging a stolen application credential to authenticate as a trusted service principal in customer environments. This allowed the attacker to inherit all permissions previously granted to the application, including broad access to emails, files, and directory data. The attack was confirmed by multiple independent sources, including Microsoft, Huntress, and ConnectWise. The incident led to the suspension of ConnectWise Cloud Backup and related services, with ongoing investigations and remediation efforts. There is currently no evidence that backup archives were accessed or exfiltrated, but the full scope of tenant impact remains under review. The attack bypassed multi-factor authentication (MFA) due to its use of application credentials rather than user logins.

A food analytics expert says a cyberattack like the one that recently targeted grocery store chains in France is possible here. Some 700 food retailers in that country were struck earlier this week by hackers who remotely turned up the heat in thousands of coolers and freezers causing significant food losses – and even starting fires. Sylvain Charlebois of the Food Analytics Lab at Dalhousie University says similar cyberattacks have already occurred in this country, including one affecting Sobeys in 2022. “Most of our grocers have actually been cyberattacked already,” says Charlebois. He says Sobeys had to pay a ransom of $25 million at that time. “It is a real threat to our grocers and not just our grocers, but the entire food supply chain.”(VOCM News)Charlebois suspects that the incidents in France were precipitated by a ransom demand that the grocers refused to pay. He says grocers typically have a number of systems in place to protect their inventory, but there are still vulnerabilities.

Digital Care Hub has launched a series of new resources to help adult social care providers plan how they will communicate with key stakeholders in the event of a cyber incident. These include people receiving care, families, staff, partner organizations and relevant public bodies. Developed in collaboration with Dr. Jason R. C. Nurse, reader in cybersecurity at Kent's School of Computing (part of the LASE University Group), the resources help providers prepare clear, useful communications before an incident occurs.