What to look out for today
Reports say hackers accessed application identities connected to ConnectWise Cloud Backup (formerly SkyKick Cloud Backup), and some Microsoft 365 tenants were compromised. ConnectWise has shut down customer access to the service while responding.
If your IT provider (or your business) uses ConnectWise or cloud backup services tied into Microsoft 365, treat this as a supplier risk and potential account compromise situation.
Why this matters to smaller businesses
- Single supplier, wide blast radius: one MSP/backup tool can have admin-level access across many small businesses.
- Business disruption risk: backup access interruptions can slow restores and incident response, even if you’re not breached.
- Knock-on scams: criminals often exploit high-profile supplier incidents to send believable fake “security update”, “reset your password”, or “urgent invoice” messages.
Warning signs
- Unexpected Microsoft 365 sign-ins (new locations/devices) or unusual activity on mailboxes and OneDrive/SharePoint.
- New or changed app registrations, “consented” apps, or unfamiliar third-party apps suddenly having access to Microsoft 365 data.
- Mailbox rules you didn’t create (e.g., auto-forwarding, hiding emails, moving messages to RSS/Archive).
- Users reporting “password reset” prompts or MFA fatigue/approval requests they didn’t initiate.
- Your IT provider tells you backups are temporarily unavailable, delayed, or “in maintenance” without clear explanation and timelines.
- Incoming emails/calls claiming to be ConnectWise/your MSP asking you to log in, approve access, or pay an urgent fee.
How attackers may exploit the situation
- Abuse of trusted application identities to access Microsoft 365 tenants without needing a user’s password.
- Email compromise and invoice fraud: reading email threads, diverting payments, or inserting new bank details at the right moment.
- Data theft for follow-on extortion: copying files from OneDrive/SharePoint or emails from mailboxes.
- Supplier-themed phishing: fake incident updates, “restore your backup” links, or bogus support calls targeting finance and admins.
What to do today
- Confirm exposure: ask your IT provider (or internal IT) whether you use ConnectWise Cloud Backup / SkyKick Cloud Backup and whether your tenant is potentially affected.
- Check Microsoft 365 activity: review sign-in alerts and look for unusual mailbox rules and unexpected third-party app access.
- Reconfirm payment-change controls: remind staff that bank detail changes must be verified out-of-band (known phone number, not email).
- Backup continuity: ensure you have a clear restore path if cloud backup access is disrupted (including any secondary/offline or alternative backup arrangements).
- Brief staff in 2 minutes: “If you get a ConnectWise/MSP ‘urgent security’ message today, don’t click—forward to IT.”
Ask your IT provider
- Do we use ConnectWise Cloud Backup (or any ConnectWise services) connected to our Microsoft 365 tenant? If yes, what level of access does it have?
- Have you received any vendor notification indicating our tenant may be impacted? What evidence have you checked?
- What’s our current status for: mailbox access, OneDrive/SharePoint access, and backup/restore capability?
- What logs have you reviewed for unusual OAuth/app activity and mailbox rule changes?
- If our backup access is interrupted, what is the fallback restore plan and expected recovery times?
- What user-facing comms should we send today to reduce phishing and payment-diversion risk?
Patch watch - only one short paragraph, and only if relevant
This is primarily a supplier/identity access issue rather than a “patch now” item. Still, use today as a prompt to ensure Microsoft 365 admin accounts are protected with strong MFA, and that third-party app access is reviewed and limited to what’s necessary.
One action today
Ask your IT provider today to confirm whether any ConnectWise Cloud Backup/SkyKick identities have access to your Microsoft 365 tenant, and to review your tenant for unusual app consents and mailbox rule changes.
Related Actions On Cyber resource
Actions On Cyber checklist: Supplier incident response mini-checklist (questions to ask your MSP, what to verify in Microsoft 365, and staff comms template)
Sources
- Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.