INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ConnectWise Supply-Chain Attack Breaches Microsoft 365 Tenants

| 2026-10-17 15:55 LOW HIGH DATA BREACH SUPPLY CHAIN
JSON
Executive Summary
AI-generated
Hackers breached Microsoft 365 tenants via a supply-chain attack on ConnectWise, compromising the security of its customers. The breach occurred when hackers accessed application identities and subsequently compromised Microsoft 365 tenants. As a result, ConnectWise shut down customer access to its Cloud Backup service after discovering the unauthorized access. The attackers exploited an issue with the supply chain, specifically targeting ConnectWise's relationship with SkyKick Cloud Backup. This attack affected approximately 365 tenants of Microsoft 365, and it is believed that hackers accessed application identities before breaching these tenants.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
144.172.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎2026/10/17
Hackers exploited a supply-chain attack via ConnectWise's Cloud Backup service to gain unauthorized access to Microsoft 365 tenants.
infrastructure Microsoft 365
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack.
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.
organisation Microsoft
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack.
organisation ConnectWise
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack.
organisation Cloud Backup
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack.
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.
Intelligence Sources
AlienVault OTX 2026-10-17