What happened
ConnectWise says unauthorised access occurred through application identities associated with Cloud Backup, formerly SkyKick. On October 15, 2026, Sophos X-Ops observed the token sweep between 07:11 and 08:47 UTC. The researchers saw the application identity request one app-only Microsoft Graph token in each targeted tenant, in ascending tenant order and at intervals consistent with scripted enumeration. Sophos found no evidence of hands-on-keyboard activity in the tenants it reviewed and no creation of new secrets, applications, consents or role assignments at publication. That finding constrains observed behaviour; it does not establish that every tenant was unaffected or show how issued tokens were used.
Sophos X-Ops observed app-only Microsoft Graph token requests from 144.172.64[.]128 using Python-urllib/3.12 and python-requests/2.31. ConnectWise also published 144.172.64[.]99 and 144.172.64[.]60 for Microsoft 365 authentication and audit-log review. ConnectWise says mitigations began on October 17, 2026 at 05:00 UTC, and it completed a full reset of accounts and credentials in the affected Cloud Backup environment on October 19, 2026. The ConnectWise advisory was updated on October 21, 2026 at 00:30 UTC as remediation and validation continued. Partners were still instructed to keep affected application connections disabled and review their own and every managed customer tenant.
Cloud Backup, SaaS Security and Cloud Management remain suspended; scheduled backups, archive access, restores, security monitoring and user or licence management cannot currently be used. ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication of archive compromise, and reports no indication that other ConnectWise products are affected. It also states that those central findings do not establish whether individual partner or customer Microsoft 365 environments were affected. The cited sources did not publish the number of partner or customer tenants affected or explain how the application credential was obtained. Attribution posture: ConnectWise and Sophos name no actor, and responsibility for obtaining the application credential remains unresolved.
Why this matters now
This is a privileged third-party identity problem, not a conventional stolen-user-password event. The Cloud Backup application operated as a multi-tenant Microsoft Entra application and could request app-only Microsoft Graph tokens wherever consent existed. Those requests did not require an end-user password or MFA challenge. Sophos also observed the sweep reaching tenants without an active backup subscription, which means current billing or service records may not define the exposure population. Enterprises and MSPs therefore need a historical consent inventory, not merely a list of active customers.
The incident also removes several controls at once. Cloud Backup, SaaS Security and Cloud Management remain suspended; scheduled backups, archive access, restores, security monitoring and user or licence management cannot currently be used. That combines an identity-investigation requirement with reduced backup and monitoring capability during the same response window. ConnectWise’s central credential reset is necessary containment, but it cannot establish how tokens were used inside each customer tenant, whether local persistence was created, or whether missing audit retention prevents a defensible conclusion.
The decision for security leaders
Assign the identity team and each Microsoft 365 service owner to produce a tenant-by-tenant disposition. Review service-principal sign-ins, audit events and Graph activity; identify unexpected credentials, applications, consents, roles, mailbox rules or delegated access; and record where log retention prevents a conclusion. Former SkyKick users must remain in scope because Sophos observed enumeration of tenants without active subscriptions.
Separate three decisions that can otherwise be conflated: whether ConnectWise contained its environment, whether each customer tenant shows evidence of misuse, and whether the business can safely reconnect the applications. Reconnection should require vendor instructions, completed tenant evidence, an explicit risk owner and a tested continuity position for backup and monitoring. A central credential rotation cannot substitute for downstream compromise assessment.
Evidence of closure
- A tenant register records application consent, sign-in findings and an approved disposition.
- Preserved Entra and Microsoft 365 audit exports cover the vendor-specified review period.
- No unexplained Graph activity, credentials, consents, roles or mailbox changes remain.
- Reconnection approval records the accountable owner and applicable vendor restoration guidance.
The Security.io assessment
The strongest current evidence supports an automated, cross-tenant token sweep using a vendor application identity. Sophos did not observe hands-on-keyboard activity or common application-persistence changes in reviewed tenants, which lowers the observed depth of intrusion but does not prove tokens were unused. Microsoft Graph activity evidence, tenant-specific audit retention and identification of unexplained changes are the deciding artefacts. Where those artefacts are unavailable, leaders should record residual uncertainty rather than declare the tenant clean.
ConnectWise’s reset and continuing suspension show that restoration is being treated as a security validation exercise rather than a simple availability event. That is appropriate because Cloud Backup’s privileged placement creates both data-access and resilience consequences. The enterprise risk remains concentrated in historical consent, provider-held credentials and customer-specific evidence. Escalation is justified when indicator matches align with sensitive Graph activity, persistence changes or missing logs that prevent reconstruction.
Questions for the morning meeting
- Can every current and former Cloud Backup or SkyKick customer tenant be enumerated?
- Who can authorise reconnection after tenant evidence and vendor guidance are reviewed?
- How long can operations tolerate unavailable backup, restore and SaaS security functions?