ConnectWise disables seven app identities after hackers breach Microsoft 365 tenants via Cloud Backup

Hackers accessed application identities of ConnectWise Cloud Backup (formerly SkyKick) and used them to compromise Microsoft 365 tenants. ConnectWise responded by shutting down customer access to its Cloud Backup service and disabling seven specific application identities, including ID 506e08f9-6e9a-4da4-942b-a099a03644ae, while investigations continue.
Why it matters: MSPs and enterprises relying on third‑party backup services must reassess supply‑chain security for Microsoft 365 environments.
Read the coverage
BleepingComputerHackers breach Microsoft 365 tenants via ConnectWise supply-chain attack ↗bleepingcomputer.com · 19h ago
The Hacker NewsHackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants ↗thehackernews.com · 28h ago
The Hacker NewsConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants ↗thehackernews.com · 2h ago
This story so far
How it developed, day by day.
Tuesday 20 October
ConnectWise suspends Cloud Backup service after confirming unauthorized accessSunday 18 October
ConnectWise disables seven app identities after hackers breach Microsoft 365 tenants via Cloud Backup (this page)