At 06:13 UTC on October 15, an address on the public internet began signing into Microsoft 365 tenants. It did not stop. By 08:34 it had authenticated against 173 customer environments that the security firms Huntress and Todyl have since confirmed, moving from one to the next in seconds.
The credential was not a password. It belonged to a Microsoft 365 application published by ConnectWise Cloud Backup, a product formerly sold as SkyKick. IT service providers install the app so they can back up customers’ mailboxes, files and team sites, and it is built to work across every tenant they manage.
That design is the vulnerability. To do its job the application holds read and write permission to mail, OneDrive, SharePoint, Teams and directory data, granted once by an administrator who clicked through a consent screen. One key opens every door in the building, and the building is the customer list.
The logs describe a script rather than a person. Sign-ins proceeded in the order of tenant identifiers, a few seconds apart, which is what a loop over a list looks like. Nobody types that fast, and nobody has reason to visit 173 tenants in 141 minutes.
ConnectWise said it suspended the application’s access once it learned of the activity. The suspension has a limit built into it. Access tokens already issued by Microsoft remain valid until they expire, for as long as 90 minutes, which means the response began while the attacker still held working keys.
Microsoft has not said how the credential was obtained. The possibilities are familiar: a secret left in a code repository, a phishing page that harvested an app secret, a compromised vendor employee, or a flaw in how the app stored its own credentials. Each points to a different fix, and neither company has described which one applies.
What the incident makes visible is the shape of the managed service provider. A regional IT firm with forty clients runs a stack of tools it did not write: a remote monitoring agent, an endpoint protection console, a backup service, a documentation wiki. Each holds privileged access to every client. The firm’s security posture is therefore the security posture of forty companies that have never heard of it.
Buyers of those services rarely see the stack. A mid-sized manufacturer signs a contract for managed IT, receives a monthly report and assumes its data sits behind its own login. In practice the data sits behind an app registration created three years ago by a technician who has since left.
Microsoft’s own consent framework makes this easy to do and hard to see. A publisher verifies its identity, an administrator grants access once, and the grant persists until someone revokes it. Nothing in the admin center prompts a review a year later, and no standard report lists which third-party applications hold mail access across a tenant.
The economics push the other way. Small and mid-sized organizations cannot staff a security team, and the tools that let a five-person provider serve forty clients are the reason the price works at all. Consolidation into platforms has made those tools better and has made each one a larger target.
Detection is the harder problem. The sign-ins carried a valid token from a verified application, at plausible hours, against tenants that had consented to the app. Rules that flag impossible travel or unfamiliar browsers had little to work with. What distinguished the traffic was its speed and its breadth, and catching that requires correlating across customers who do not share a telemetry pipeline.
Notification is now the operational burden. Each of the 173 tenants is a separate legal entity with its own obligations, and the clock on those obligations started on October 15 whether or not the customer has been told. Some states require notice within 30 days, some within 72 hours, and the contracts between providers and clients add deadlines of their own.
The technical cleanup is more tractable. Revoking the app’s consent, rotating its secret, forcing reauthentication and reviewing mailbox rules and forwarding entries covers most of the ground. Attackers who obtain this kind of access usually leave a forwarding rule and an OAuth grant behind, and both survive a password reset.
What the case does not establish is intent. Bulk sign-ins across hundreds of tenants could be reconnaissance, mailbox theft, or the first stage of an extortion campaign that has not been announced. The pattern of the past two years favors the last: access brokers who map environments and sell entry to someone else.
For the customers, the useful question is not whether ConnectWise or Microsoft failed. It is which applications in their own tenant hold tenant-wide permission, who approved them, and when anyone last checked. Most organizations can answer the first and neither of the others.
The concentration is the part that no patch will fix. Every move toward platform consolidation reduces the number of vendors a company must trust and raises the value of each one’s credentials. The count of keys falls, the worth of a single key rises, and the arithmetic of an attack inverts with it.
The detail worth keeping is the timestamp. Two hours and 21 minutes is roughly the length of a morning meeting. A control that depends on someone noticing, on a Tuesday, that a backup tool is logging into 173 customers is not a control. It is a hope with a dashboard attached.
