ConnectWise Cloud Backup Breach Opens Door to Thousands of Microsoft 365 Tenants

# ConnectWise Cloud Backup Breach Opens Door to Thousands of Microsoft 365 Tenants

Microsoft says China state-aligned hackers stole the credentials a backup service uses to reach customer data, then used AI agents to sign in to about 2,250 organizations at machine speed

By Kaeleb Savon Heck | Mr. Blindbandit Chronicle. This is original reporting and analysis based on the public sources listed at the end.

Oct. 23, 2026 — Hackers that Microsoft describes as aligned with the Chinese state broke into ConnectWise's cloud backup service, stole the application credentials it uses to connect to customers' Microsoft 365 environments, and used them to get into about 2,250 organizations. TechCrunch reported the findings on Thursday, Oct. 22. ConnectWise, a large supplier of IT management and remote-access software to managed service providers, has paused access to the service while it investigates. As of Thursday, the company said it was working to bring the service back.

What sets this incident apart is the pace. Microsoft said the attackers used AI agents to try close to 3,000 sign-ins per minute, a speed it said gives defenders "little time to detect and respond." The attackers did not need to defeat each victim's own defenses. They took over a trusted vendor's access and used that.

What happened

ConnectWise Cloud Backup, which was sold as SkyKick Cloud Backup before the rebrand, keeps copies of customers' Microsoft 365 data, including mail, files and related content. Doing that requires an application identity in each customer tenant: credentials that let the backup service read data on a schedule without a person signing in.

According to Microsoft's research as summarized by TechCrunch, the attackers got into the backup service and took those application credentials. With them, they could authenticate to customer tenants as if they were the legitimate backup application and read email and other files.

TechCrunch reported that the automation came from ARTEX, an open-source AI framework built to work with AI models to stress-test cyber defenses. The same outlet reported that ARTEX also figured in a recent compromise of South Korean financial systems, many of which had weak security and no multi-factor authentication.

Timeline

Kaseya's weekly breach roundup, published Oct. 21, sets out the early sequence. Kaseya competes with ConnectWise, which readers should keep in mind, but the timeline matches the public statements it cites:

• Oct. 13: The date from which administrators are advised to review application secrets and certificates for unauthorized additions.
• Oct. 15: Microsoft reported unauthorized authentication attempts from an IP address.
• Friday, Oct. 16: Administrators began reporting unauthorized access to client data in Microsoft 365 tenants.
• Following days: ConnectWise said it had found unauthorized access to application identities in the Cloud Backup environment and shut off application access for partners and clients.
• Oct. 22: TechCrunch published Microsoft's attribution and the estimate of about 2,250 affected organizations.

Kaseya also reported that scheduled backups had stopped, that customers could not reach affected backup archives or restore from them, and that ConnectWise had temporarily taken its SaaS Security and Cloud Management products offline during the review.

Background: why backup vendors are high-value targets

To do its job, a cloud backup service needs broad, persistent, read-heavy access to large amounts of data. That makes its credentials some of the most valuable in a company's environment. They are built to be used without a person present, they often carry wide permissions, and their activity is expected, so it can blend into normal logs.

Managed service providers make the effect larger. Many small and mid-sized businesses do not run their own IT. They hire an MSP, and the MSP uses tools like ConnectWise's to manage dozens or hundreds of clients. When one of those tools is compromised, the damage spreads down the chain: vendor to MSP to every client the MSP serves.

Security teams have seen this before. Attacks on remote management and software supply chains have repeatedly turned one breach into thousands. This case adds machine-speed automation to that model.

Analysis: the speed problem

Microsoft's warning about speed matters more than any single number in the story. Much of incident response still depends on a person seeing an alert, triaging it, and acting. If attackers can try thousands of authentications a minute across thousands of tenants, much of the damage can be done before anyone has opened the ticket.

That does not make defense hopeless, but it changes where defenses have to sit. Controls that work automatically count for more, such as conditional access policies, limits on where application identities can sign in from, short-lived credentials, and alerts on unusual service-principal behavior. So does cutting back how much any one third-party application can reach.

There is an accessibility side as well, close to this publication's own beat. Small organizations, including disability nonprofits, community groups and independent creators, often rely completely on MSPs and bundled SaaS tools because they have no in-house security staff. Vendor-level breaches hit them hard, and they often have the least capacity to run a forensic review on their own. Clear and accessible guidance from vendors after an incident is a practical security issue for these groups, not a nicety.

What administrators can do now

The following steps reflect the guidance in the cited reporting and standard practice for this kind of incident:

1. Audit application credentials. In Microsoft Entra ID (formerly Azure AD), check app registrations and enterprise applications for secrets or certificates added since Oct. 13, and remove any you cannot account for. Kaseya noted that shutting down the vendor's service does not remove credentials already planted in customer tenants.
2. Review sign-in logs for service principals. Look for high-volume authentication, sign-ins from unfamiliar IP addresses, or access patterns that do not match your backup schedule.
3. Rotate related credentials. Treat secrets connected to third-party backup and management tools as possibly exposed.
4. Check mailbox and file access. Where audit logging allows, look for bulk reads of mail and documents in the window after Oct. 13.
5. Plan for recovery without the backup. With restores unavailable for now, confirm what other recovery options exist if something else goes wrong in the meantime.
6. Tighten conditional access. Where your licensing supports it, limit where and how application identities can authenticate.

What's next

Several questions remain open:

• Scope. ConnectWise has not published a final count of affected customers. The roughly 2,250 figure comes from Microsoft's research as reported by TechCrunch.
• Data taken. It is not yet public how much data was read or copied from each tenant.
• Restoration. Customers are waiting to hear when backups will run again and when archives will be reachable, and whether the service will come back with re-issued credentials.
• Attribution details. Microsoft's attribution to China state-aligned actors is reported. More technical detail may follow in Microsoft's own threat-intelligence publications.

The disclosure came during a week crowded with other breach announcements. Kaseya's roundup also covered a credential-theft campaign against GitHub repositories and a third-party breach of California student data, which the Chronicle is covering separately. The common pattern is stolen credentials used through channels the victims already trusted.

The Chronicle will update this story as ConnectWise and Microsoft release more information.

Sources

• TechCrunch: "Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise" (Oct. 22, 2026)
• Kaseya: "The Week in Breach News: October 21, 2026"