ConnectWise has expanded its response to the Cloud Backup breach affecting Microsoft 365 customers. In an October 18, 2026 update at 01:00 UTC, the company said Cloud Backup remained suspended and SaaS Security and Cloud Management had also been taken offline as a precaution. It reported disabling seven application identities on October 17 and revoking affected connection certificates.

The backup service, formerly SkyKick, serves managed service providers. Huntress said its application has broad access to customer email, files, Teams and directory data. Its published investigation confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on October 16; that dated count describes its observed scope, not a final incident total.

According to Huntress, attackers used a vendor-held application credential to obtain Microsoft Graph tokens on October 15 between 06:13 and 08:34 UTC. Requests came from 144.172.64[.]128 and moved through tenants seconds apart, suggesting scripted targeting. SpecterOps explained that this application-only authentication involves no user or multifactor authentication prompt.

SpecterOps also described a Huntress finding in one tenant: a separate ConnectWise Teams management application assigned itself Global Administrator and added credentials to two other applications. Such changes can preserve access after the original credential is reset. The analysis illustrates why reviewing other application identities is part of containment.

ConnectWise said scheduled backups and restoration access remained unavailable, with no restoration time announced. Existing archives were preserved, encrypted and isolated, with no evidence they had been accessed. The company cautioned that these findings do not establish whether live customer Microsoft 365 environments were affected. The original credential-exposure mechanism remains under investigation.

The vendor urged partners to keep affected connections disabled, preserve logs and inspect credentials, permissions and mailbox rules across their own and customer tenants. Previously issued tokens or separately established access may survive the initial containment. Administrators should assess backup recovery gaps and follow restoration guidance. Successful authentication alone does not establish that data was copied.