{"id":11031,"date":"2026-10-19T20:57:25","date_gmt":"2026-10-20T00:57:25","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=11031"},"modified":"2026-10-19T20:57:25","modified_gmt":"2026-10-20T00:57:25","slug":"connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/","title":{"rendered":"ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack"},"content":{"rendered":"<p dir=\"ltr\"><a href=\"https:\/\/www.connectwise.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">ConnectWise<\/a> has suspended its Cloud Backup service, formerly known as SkyKick, after a suspected supply chain attack that security teams first spotted on Wednesday. The company also paused SaaS Security and Cloud Management, since both connect to Cloud Backup. A spokesperson told Cybersecurity Dive that nothing so far shows partner backup data was compromised.<\/p>\n<p dir=\"ltr\">The service matters because of what it can reach. Managed service providers use it to protect <a href=\"https:\/\/hostingdiscussion.com\/news\/dutch-tax-authority-drops-microsoft-365-cloud-plan-for-on-premises-hosting\/\">Microsoft 365<\/a> and Google Workspace data, so it holds access to <a href=\"https:\/\/hostingdiscussion.com\/news\/onedrive-cloud-storage-shrinks-as-microsoft-adds-shared-copilot-ai\/\">OneDrive<\/a>, SharePoint, Teams and directory information. That reach makes a compromised app far more dangerous than a stolen password for one mailbox.<\/p>\n<p dir=\"ltr\">Microsoft Threat Intelligence confirmed on Saturday that it is tracking an active supply chain attack targeting a trusted OAuth app for ConnectWise Cloud Backup. Customers grant this multitenant application permission to operate inside their own tenants, and Microsoft assesses the attacker likely exploited permissions customers had already handed over. Researchers observed broad successful authentication on Thursday from IP address 142.172.64[.]128, followed by Microsoft Graph API reconnaissance and attempts to plant extra credentials as a backdoor.<\/p>\n<p dir=\"ltr\">Huntress described a different angle on the same event. Its blog says a compromised user credential for Cloud Backup gave unauthorized access to Microsoft 365 users, and it confirmed unauthorized sign-ups in 162 customer tenants. Jon Semon, a principal security operations analyst, said a partner tip kicked off an investigation that grew into a rapid response across several Huntress teams.<\/p>\n<p dir=\"ltr\">From a separate hosting address, the attackers tried to sign into more than 1,000 protected Microsoft 365 accounts and succeeded with over 300. <a href=\"https:\/\/www.todyl.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Todyl<\/a>, another security platform for managed service providers, confirmed impact from the same attack.<\/p>\n<p dir=\"ltr\">Anyone running this service should follow ConnectWise\u2019s guidance without delay. Lock down what you can while preserving sign-in and audit records. Go through application and user authentication, application credentials, and federation trusts. Hunt for unauthorized mailbox forwarding rules, unexpected inbox changes, or delegated mailbox access you did not set up, and dig into any identities that changed hands or saw unusual activity during the suspicious window.<\/p>\n<p dir=\"ltr\">A word of caution: the full picture is still coming together. No one has named the attacker yet, and the exact entry point remains an open question. That said, the core lesson is already sitting in plain sight: every vendor you let into your tenant brings your exposure along for the ride.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ConnectWise has suspended its Cloud Backup service, formerly known as SkyKick, after a suspected supply chain attack that security teams first spotted on Wednesday. The company also paused SaaS Security and Cloud Management, since both connect to Cloud Backup. A spokesperson told Cybersecurity Dive that nothing so far shows partner backup data was compromised. The [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2438,8478,8480,2772,8479,6860],"class_list":["post-11031","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cloud-backup","tag-connectwise","tag-managed-service-provider-security","tag-microsoft-365","tag-skykick","tag-supply-chain-attack"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"ConnectWise has suspended its Cloud Backup service, formerly known as SkyKick, after a suspected supply chain attack that security teams first spotted on Wednesday. The company also paused SaaS Security and Cloud Management, since both connect to Cloud Backup. A spokesperson told Cybersecurity Dive that nothing so far shows partner backup data was compromised. The [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-20T00:57:25+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/\",\"name\":\"ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-10-20T00:57:25+00:00\",\"dateModified\":\"2026-10-20T00:57:25+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/","og_locale":"en_US","og_type":"article","og_title":"ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack - Web Hosting News","og_description":"ConnectWise has suspended its Cloud Backup service, formerly known as SkyKick, after a suspected supply chain attack that security teams first spotted on Wednesday. The company also paused SaaS Security and Cloud Management, since both connect to Cloud Backup. A spokesperson told Cybersecurity Dive that nothing so far shows partner backup data was compromised. The [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/","og_site_name":"Web Hosting News","article_published_time":"2026-10-20T00:57:25+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/","url":"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/","name":"ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-10-20T00:57:25+00:00","dateModified":"2026-10-20T00:57:25+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"ConnectWise suspends Cloud Backup after Microsoft 365 supply chain attack"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":39,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=11031"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11031\/revisions"}],"predecessor-version":[{"id":11032,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11031\/revisions\/11032"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=11031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=11031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=11031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}