Global – October 17, 2026 -- ConnectWise is investigating attempted unauthorized access to its Cloud Backup for Microsoft 365 service, formerly SkyKick Cloud Backup, after disclosing the incident on October 16. The company says containment measures are in place and it has no indication that partner backup data was accessed. The investigation is ongoing.
Community reports allege attacker used the backup app's Entra credentials
Separate reports in the MSP community describe an attacker using the backup service's Microsoft Entra application to enter customer tenants and exfiltrate email, SharePoint and Teams data. ConnectWise has not confirmed these reports.
ConnectWise published indicators tied to the suspicious authentication activity: source IP 144.172.64.128 and the user agents Python-urllib/3.12 and python-requests/2.31. The company notes that their presence alone does not confirm compromise.
Tenant-wide app permissions let one vendor breach reach many clients
Backup services connect through a Microsoft Entra application that an administrator approves with tenant-wide permissions. The application reads data without a user sign-in, password or MFA prompt, which unattended backups require. If its credentials are compromised, access is possible in every tenant that approved it, typically with read access to mail, SharePoint and Teams.
Detection is difficult because bulk reads of mailboxes and files are normal for a backup service, and user-focused controls such as MFA do not apply to application sign-ins. MSPs often deploy one backup vendor across many clients, so a single vendor incident can affect a large number of organizations.
Coalition and Wirespeed list five steps for affected tenants
The application appears in Entra as "SkyKick Backup" or "ConnectWise Cloud Backup," with App ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Its presence confirms the organization is a customer, not that it was compromised. Recommended actions:
- Disable the application under Enterprise applications by setting "Enabled for users to sign-in" to No. Backups stop until it is re-enabled after ConnectWise confirms remediation.
- Search Entra sign-in logs and the Microsoft 365 unified audit log for the App ID, the IP address or the two user agents.
- Investigate unusual bulk access to mailboxes, SharePoint or Teams, especially outside the normal backup schedule.
- Export sign-in and audit logs, because default retention periods may be shorter than an investigation requires.
- Report matching activity; Coalition policyholders should contact Coalition.
Wirespeed notifies all backup customers and launches new detections
Security teams at Coalition and Wirespeed began investigating before ConnectWise's disclosure, based on early community reports. Coalition identified policyholders using adjacent ConnectWise SaaS technology and sent them a Zero-Day Alert. Coalition cannot tell from external data which of those organizations use the backup service, so the alert was precautionary and included verification steps.
Wirespeed can see which of its customers run the backup service in their Microsoft 365 tenants and whether the known attacker activity appears there. It has notified all of those customers. It has also launched new Managed Detections to alert on malicious activity tied to ConnectWise Cloud Backup for Microsoft 365.
Both firms will keep monitoring and will update guidance once ConnectWise confirms remediation. They also advise organizations to review all third-party applications with access to their Microsoft 365 tenant, including those connected by an MSP.