Security Incident

Global – October 17, 2026 -- ConnectWise is investigating attempted unauthorized access to its Cloud Backup for Microsoft 365 service, formerly SkyKick Cloud Backup, after disclosing the incident on October 16. The company says containment measures are in place and it has no indication that partner backup data was accessed. The investigation is ongoing.

Community reports allege attacker used the backup app's Entra credentials

Separate reports in the MSP community describe an attacker using the backup service's Microsoft Entra application to enter customer tenants and exfiltrate email, SharePoint and Teams data. ConnectWise has not confirmed these reports.

ConnectWise published indicators tied to the suspicious authentication activity: source IP 144.172.64.128 and the user agents Python-urllib/3.12 and python-requests/2.31. The company notes that their presence alone does not confirm compromise.

Griffin -- Brightmoor Hospice, LLC began mailing breach notifications on October 16, 2026, after two employee email accounts were accessed without authorization and found to contain protected health information of certain patients.

Unauthorized access lasted two days in March 2026

Brightmoor discovered suspicious activity on or around March 25, 2026. Third-party specialists determined that the two accounts were accessed between March 24 and March 25, 2026. The company secured the accounts immediately and began reviewing their contents.

Review confirmed patient data on August 18, 2026

Brightmoor determined on August 18 that protected health information was present in the accounts. It then reviewed internal records to locate addresses for potentially affected individuals. Mailing began 59 days later. The company has not stated how many individuals are affected.