ConnectWise Cloud Backup (SkyKick) Incident: What Microsoft 365 Customers Should Check

On October 16, 2026, ConnectWise disclosed unauthorized access to the application credentials behind its Cloud Backup service, formerly known as SkyKick. Cloud Backup is a Microsoft 365 backup tool used by many IT providers to protect their clients' email, OneDrive, SharePoint and Teams. On October 21, Microsoft said a China-aligned group it tracks as Storm-0940 was responsible, and that the group used an AI agent tool called ARTEX to try to sign in to more than 2,250 Microsoft 365 tenants through those trusted backup apps.

This matters for small and mid-size businesses because a backup app like this is usually granted broad permission to read mail and files. Whoever holds its credentials can reach a company's Microsoft 365 without anyone's password and without a normal user sign-in.

The short version: if your business or your IT provider uses ConnectWise Cloud Backup or SkyKick, keep those apps turned off in Microsoft 365 for now, and have someone review your sign-in and audit logs since mid-October for changes nobody approved.

What happened

According to ConnectWise, it found the problem on October 14, disabled seven of its Microsoft 365 application identities on October 17, and suspended Cloud Backup, SaaS Security and Cloud Management while it investigates. ConnectWise says existing backup archives remain encrypted and isolated with no indication they were compromised, and that it has no indication other ConnectWise products are affected. As of its October 23 update, it expects to let partners restore from existing backups early next week, with full re-enrollment to follow.

Microsoft says that in several affected tenants the attackers went beyond signing in. They looked around through Microsoft Graph, added new credentials to apps so they could come back later, and tried to change users, groups and administrator roles. Microsoft also says the presence of the app, or even a successful sign-in, does not by itself mean data was taken. Microsoft states that the activity did not come from a flaw in Microsoft's own systems.

One important point from both companies: ConnectWise turning off the apps on its side stops new sign-ins through them, but it does not undo changes an attacker may already have made inside your tenant. Each Microsoft 365 tenant has to be checked on its own.

Who is at risk

• Businesses whose Microsoft 365 is backed up with ConnectWise Cloud Backup or the older SkyKick Cloud Backup.
• Businesses where SkyKick or ConnectWise Cloud Management was ever connected, even if it is no longer used. ConnectWise asks partners to check dormant connections too.
• IT providers who manage many client tenants with these tools, since one trusted connection can reach every client.

What to do this week

1. Find the apps. In the Microsoft Entra admin center, look under Enterprise applications for ConnectWise or SkyKick entries. Match on the Application ID, not the name. The Cloud Backup app ID is 506e08f9-6e9a-4da4-942b-a099a03644ae, and ConnectWise lists six more on its advisory page.
2. Disable, don't delete. Set those apps so they cannot sign in, and keep them off until ConnectWise publishes restoration instructions. Both ConnectWise and Microsoft advise against deleting them first, because the app records are evidence.
3. Save your logs now. Export Entra sign-in and audit logs. On the free tier Microsoft keeps about seven days of history, and 30 days on P1 or P2, so older records may already be gone.
4. Review sign-ins since October 13. Check the service principal sign-ins for those apps, and look for activity from the addresses ConnectWise and Microsoft published (144.172.64.128, 144.172.64.99 and 144.172.64.60) or anything outside normal vendor activity.
5. Look for quiet changes. Check for new app credentials or secrets, new apps or app owners, new administrator role assignments, consent grants, Conditional Access changes, new mailbox forwarding, hidden inbox rules and new mailbox permissions.
6. Plan for the backup gap. Scheduled backups through Cloud Backup are paused. Note your last good backup date and decide whether you need a temporary way to protect important mail and files until service returns.

Questions to ask your IT provider

1. Do we have any ConnectWise or SkyKick apps connected to our Microsoft 365, now or in the past, and are they disabled?
2. Have our sign-in and audit logs been saved and reviewed since mid-October, and was anything found?
3. Were any new administrators, app credentials or mail forwarding rules added that nobody approved?
4. How are our Microsoft 365 mail and files being backed up while this service is paused?

Sources

• ConnectWise Trust Center: Cloud Backup (formerly SkyKick) advisory and updates
• ConnectWise: Cloud Backup technical investigation and remediation guide (PDF)
• Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
• Huntress: ConnectWise (SkyKick) vendor credentials abused in M365 attacks