The backup login opened the tenant

The backup app already had the keys. Someone used them.

ConnectWise cut partner and customer access to Cloud Backup, the old SkyKick Cloud Backup, after it found unauthorized use of application identities in that environment. Huntress says it has at least 162 compromised tenants in what it monitors. Microsoft says it saw unauthorized authentication attempts against that service on 15 October. ConnectWise says it has no indicator so far that the stored backup archive was taken, and that the archive will be reachable when the service returns. That sentence is about the copy. It is not about the live mailbox the app was allowed to read.

The app signs in as itself. There is no person to challenge. Todyl’s write-up of nine tenants: the attacker authenticated as the backup application with its secret and inherited whatever the customer had already granted. In those nine, they did not see new accounts, new roles, or password changes. Huntress, on nearly fifty tenants, saw ConnectWise cloud-management principals assign themselves directory roles, mostly Exchange Administrator. In one tenant it saw persistence in about five minutes. Microsoft called it an active supply-chain attack. Victim count and what was read from each mailbox are still open.

What 162 will be asked to cover

It will be briefed as “every MSP backup is gone.” ConnectWise has not said the archive left. It will be briefed as each customer’s password. The password was not the door. The application secret was. MFA on a user login does not see this. Stopping the vendor’s shared credentials does not retire a secret already planted in a tenant.

If you are an admin who granted Cloud Backup or an old SkyKick name, look at that application’s sign-ins and at secrets added since 13 October. Huntress’s advice is to turn the implicated apps off and then look. A tenant that never bought the product is not in this 162. A tenant that bought it years ago and forgot still is.

The backup being down is an outage. The tenant being signed into as the backup is the incident.