Reel · Chaos & Reliability · Oct 21, 2026
Microsoft 365 backup outage: a stolen app credential, 160+ tenants
In short
Confirmed (ConnectWise, via iTnews): unauthorised access to application identities in its Cloud Backup environment let attackers sign in to customers' Microsoft 365 tenants. ConnectWise revoked the credential and switched off the app, so backups were paused and restores unavailable, and said it had seen no sign so far that stored backup data was accessed. How the credential was stolen had not been disclosed. Reported (Huntress, via Cybersecurity News): sign-ins came from one hosting IP within minutes, and at one tenant a second app gave itself Global Administrator and added new secrets valid until 2028. The lesson: treat app identities like root.
Checklist: what to do about it
- List the third-party apps in your tenant and the permissions each one holds.
- Cut each app to least privilege. Few apps should need admin-level roles.
- Alert on new app secrets or certificates and on new role grants.
- Keep a second restore path that doesn't depend on one vendor's key.
- If an app looks compromised, disable it (don't delete it) so you keep the evidence.
- Rehearse a restore without your primary backup vendor at least once.
Sources
- iTnews: stolen ConnectWise SkyKick credential exposed Microsoft 365 tenants
- Cybersecurity News: ConnectWise credentials and Microsoft 365 accounts