In the layered architecture of cloud trust, a breach at ConnectWise reminds us that the most sophisticated perimeter means little when the keys themselves are taken. Attackers armed with legitimate SkyKick credentials walked quietly into at least 173 Microsoft 365 tenants — not through a broken wall, but through an open door. ConnectWise has suspended its SkyKick platform to investigate the full scope of the intrusion, leaving affected organizations to reckon with what may have been seen, taken, or altered within their digital archives.
ConnectWise Suspends Cloud Backup Services After Credential Compromise Exposes 173 Microsoft 365 Tenants
Potential unauthorized access to business data and systems for 173 Microsoft 365 tenant organizations.
Legitimate credentials bypassed every other defense
Mark
So ConnectWise shut down an entire service because of a credential breach. How many customers does that actually affect?
Mimi
The breach itself touched 173 Microsoft 365 tenants—that's 173 separate organizations. But SkyKick serves many more customers than that. The shutdown affects everyone using the platform, not just the compromised ones.
Luke
Right, and we don't know how many total customers that is. The reporting says 173 tenants were compromised, but it doesn't say how many organizations use SkyKick overall. So the disruption is potentially much wider than the breach itself.
Mark
What could attackers actually do with access to a Microsoft 365 tenant?
Mimi
Everything. Email, documents, collaboration files, potentially years of business records. They could read it, copy it, modify it, delete it. It depends on what permissions the compromised credentials had.
Luke
And that's the thing—we don't know what the attackers actually did. The reporting confirms they had access, but not whether they exfiltrated data, encrypted anything, or just looked around.
Mark
How did the attackers get the credentials in the first place?
Mimi
That's still unclear. The reporting doesn't specify whether it was phishing, a data breach elsewhere, or something else.
Luke
Exactly. We know credentials were compromised and used, but the attack vector isn't public yet. That's a critical gap for understanding how to prevent this from happening again.
Mark
What happens to the 173 organizations now?
Mimi
They need to audit their Microsoft 365 accounts for unauthorized access, review audit logs, and monitor for data theft. They're also without backup and management services until ConnectWise restores them.
Luke
And they're doing this investigation themselves, mostly. ConnectWise hasn't released details about what was accessed or when, so each organization has to figure out their own exposure.
Il Polso
- Stolen credentials — not a software exploit — gave attackers silent, authorized-looking entry into 173 separate business environments on Microsoft 365.
- ConnectWise pulled the plug on SkyKick's backup, security, and management services entirely, trading operational continuity for containment.
- Each compromised tenant represents a distinct organization whose email, documents, and financial records may have been exposed during an as-yet-undetermined window of access.
- The absence of a public timeline means affected businesses do not yet know how long attackers were present or what, if anything, was exfiltrated.
- Organizations are now urged to comb through Microsoft 365 audit logs and watch for signs of data theft — without the backup tools they normally rely on to do so.
In the layered architecture of cloud trust, a breach at ConnectWise reminds us that the most sophisticated perimeter means little when the keys themselves are taken. Attackers armed with legitimate SkyKick credentials walked quietly into at least 173 Microsoft 365 tenants — not through a broken wall, but through an open door. ConnectWise has suspended its SkyKick platform to investigate the full scope of the intrusion, leaving affected organizations to reckon with what may have been seen, taken, or altered within their digital archives.
ConnectWise has suspended its SkyKick cloud platform after discovering that attackers obtained valid service credentials and used them to access at least 173 Microsoft 365 customer tenants. The company shut down its backup, security, and management services as a containment measure while a full investigation gets underway.
SkyKick is designed to help organizations protect and manage their Microsoft 365 environments — making it a high-value target. Because the attackers used legitimate credentials rather than exploiting a software flaw, the intrusion was far harder to detect through conventional security monitoring. The exact method by which those credentials were obtained has not been disclosed.
The potential damage is significant. Each of the 173 tenants represents a separate organization whose email archives, documents, collaboration data, and financial records may have been viewed, copied, or altered. The window of exposure remains unknown, as ConnectWise has not yet released a timeline of when the breach was discovered or how long access persisted.
For affected organizations, the challenge is twofold: securing their accounts now and conducting forensic audits to understand what happened — all while the SkyKick tools they would normally use for that work remain offline. The incident is a sharp illustration of credential-based risk in cloud environments, where a stolen password can render even well-configured defenses irrelevant.
ConnectWise, a major provider of cloud backup and IT management tools, has suspended its SkyKick service after attackers obtained legitimate credentials and used them to breach at least 173 Microsoft 365 customer accounts. The company discovered the compromise and moved to shut down its backup, security, and management services while launching a full investigation into how the breach occurred and what data may have been exposed.
The attack centered on SkyKick, ConnectWise's cloud-based platform designed to help organizations back up, secure, and manage their Microsoft 365 environments. Attackers gained access to valid credentials for the service—the specific method of compromise has not been publicly detailed—and leveraged those credentials to infiltrate customer tenants. Each tenant represents a separate organizational account within Microsoft 365, meaning the breach potentially affected 173 distinct businesses and their associated data.
The scope of unauthorized access remains under investigation. Tenants compromised through stolen credentials could theoretically allow attackers to view, modify, or exfiltrate sensitive business information stored in Microsoft 365, including email, documents, and collaboration data. The fact that attackers used legitimate credentials rather than exploiting a software vulnerability made the intrusion harder to detect through normal security monitoring.
ConnectWise's decision to suspend SkyKick services was a defensive measure intended to prevent further unauthorized access while the company works to understand the full extent of the incident. The suspension affects not only backup functionality but also the security and management tools bundled with the platform, disrupting services for an unknown number of organizations that depend on these tools for operational continuity.
For the 173 affected organizations, the immediate concern is determining whether attackers accessed, copied, or altered their data during the window of compromise. Microsoft 365 tenants can contain years of email archives, sensitive documents, financial records, and other business-critical information. Organizations are now facing the dual challenge of securing their accounts and conducting forensic investigations to establish what was accessed and when.
The incident underscores a persistent vulnerability in cloud security: the value of legitimate credentials to attackers. Even when software is properly patched and firewalls are configured correctly, stolen or compromised credentials can bypass these defenses entirely. ConnectWise customers now face the task of auditing their Microsoft 365 accounts for signs of unauthorized access, reviewing audit logs for suspicious activity, and monitoring for any indication that data has been exfiltrated or misused.
ConnectWise has not yet released a detailed timeline of when the compromise was discovered, how long attackers had access, or what remediation steps are underway. The company's investigation will likely determine whether the credential compromise was limited to SkyKick or whether other ConnectWise services or customer data were affected. Until that investigation concludes and services are restored, organizations relying on SkyKick for backup and disaster recovery are operating without those protections.
Citazioni salienti
Organizations using ConnectWise SkyKick should audit their Microsoft 365 accounts for unauthorized access and monitor for data exfiltration— ConnectWise incident guidance (paraphrased)
Vuoi la storia completa?
Leggi l'originale su Google News ↗
Technology