Your backup tool held the keys to your mailbox
To copy your mail, a backup program has to be able to read all of it. So it holds a key. On 15 October 2026, unauthorised parties used the key of one such program to get into other companies’ Microsoft 365 environments, the place where many firms keep their mail, files and chats. The key did not belong to those companies. It belonged to the program’s vendor.
What happened
The program is called Cloud Backup, formerly SkyKick, and it belongs to ConnectWise. Managed IT providers, the outside companies that run a small business’s IT, sell it to back up the mail, files and chats of Microsoft 365. To do its job, each customer grants it broad permissions that work without any person logging in.
- 15 October: using a credential of the program, the unauthorised parties entered the environments of many organisations as if they were the program, in rapid succession.
- 16 and 17 October: ConnectWise reported unauthorised access and switched the service off.
- Since then: as of 26 October, scheduled backups, access to archives and restores had been down since 17 October. According to ConnectWise’s latest advisory (26.10.2026, 14:00 UTC), restores from existing backups reopen first, re-enrolment in the service follows, and the affected connections are to stay disabled.
Microsoft classes it as a supply chain attack, meaning one that arrives through a supplier, and says it does not stem from a flaw in its own products. How the credential was obtained has not been disclosed. According to Huntress, which published research on the case, it had confirmed unauthorised sign-ins in 162 organisations among those it monitors as of 16 October.
Access yes, copying of data not shown
An access is not a copy of the data. The program’s permissions would have allowed reading and writing messages, attachments, files and chats, but Microsoft points out that a successful sign-in does not by itself show that data was read. ConnectWise says it has no indication that partners’ backup data is compromised and that existing archives are encrypted, isolated and preserved.
That is the picture: access happened, damage still to be established. ConnectWise says each Microsoft 365 environment needs a separate review, which holds for every organisation where the program was installed.
The second check does not protect programs
Multi-factor authentication is the second check after the password, usually a code on your phone. It protects people. Here a program signed in with its own credential, and that check does not apply to sign-ins by programs. Keep it switched on. It just does not answer the question this case raises: who watches what the programs do.
The mailbox is the client file
In a firm, mail and files hold the clients’ accounts, payroll, bank statements and tax returns. Your clients entrusted those documents to you, not to your supplier’s supplier.
Usually the firm does not run Microsoft 365 alone. An IT provider does, leaning on third-party tools. Many hold a permanent permission on your environment, usually granted once by a technician with one click. Sometimes nobody remembers who granted it, when, or whether the program is still needed. Microsoft asks for a check of every environment where the affected programs are or have been installed, even if they are no longer used.
We do not know which tools you use, and your provider can tell you: you only have to ask.
Four questions for your IT provider
Ask in writing, and ask for a date to reply.
- Which third-party programs hold permanent access to our mail and files today? For each: who authorised it, when, with which permissions. Include those we no longer use.
- Have your tools been touched by recent incidents? If so: when did you tell us, and what did you check in our environment? According to ConnectWise, its containment does not remove unauthorised access that may already have been established in individual environments: have you reviewed ours as well? If you do not know yet, tell us that you do not know.
- If your backup stops for a week, where is the second copy of our mail? And when did you last test a restore: which day, how long did it take?
- Who watches the sign-ins of programs, as well as those of people? And how quickly do they warn us if a program starts doing something it has never done, such as giving itself more powers?
Three things to do on Monday
You need to buy nothing.
- Send the four questions and put the reply date in the calendar.
- Have a test mailbox restored and note the day and how long it took. Until you have tested it, you do not know that it works. If your backup is the one that is down, do not reactivate anything on your own: wait for ConnectWise’s instructions.
- Decide who, by name, receives the provider’s alerts and reads them. Better that it is someone in your firm, not the provider.
Frequently asked questions
If my provider uses this service, are my backups at risk? In the sources consulted on 26.10.2026 it is not shown that any data was read or copied, and ConnectWise says it has no indication that partners’ backup archives are compromised. While the service is down, though, those archives cannot be used to restore. Ask your provider whether it used the service, for which clients, and what it checked in your environment.
Should we change provider? The case shows that the four questions have to be asked. A precise answer, in writing and with dates, tells you more than the brand of the tool.
How long will the outage last? As of 26 October the service had been down since 17 October, and ConnectWise was restoring it in phases. The status is that of the advisory of 26.10.2026, 14:00 UTC; the restoration changes, so check the advisory.
Whoever runs your mail holds the keys to your house, and its backup program holds others. It helps to know who has them, who watches them, and what you have in hand if the custodian stops.
Sources, read on 26.10.2026: ConnectWise advisory and status page; Huntress research (16.10.2026, updated 19.10); Microsoft’s analysis (21.10.2026); reporting by BleepingComputer, The Register, Help Net Security, CyberScoop, heise online and Inside IT (in German). The analyses by ConnectWise and Microsoft also contain an assessment of who the attackers are: we do not report it here because we are not able to verify it.
