The sign-ins came from a single hosting address, 144.172.64.128, and moved through customer tenants in the order their identifiers sort, seconds apart. No password was typed. No multifactor prompt appeared. In roughly two and a half hours on October 15, an application identity belonging to ConnectWise signed into Microsoft 365 environments it was never supposed to enter, and the tenant list it walked looked like something a script had assembled in advance.
By the evening of October 16, Huntress, the security firm that first reported the activity, had confirmed unauthorized access in 162 tenants. The count reached about 173 as partners checked their logs. ConnectWise cut customer access to its Cloud Backup product on October 17, and from October 18 suspended that service along with its security management offerings while it investigates. The company said the activity traced to a credential it held, and that it is working with Microsoft and outside forensics.
The credential was not a password in the ordinary sense. ConnectWise Cloud Backup, formerly sold as SkyKick Backup, runs inside customer tenants as an application that administrators consent to during setup. It keeps a client secret on the vendor’s side and uses it to mint Microsoft Graph tokens, which is how a backup product reads mailboxes, OneDrive files, SharePoint sites and Teams conversations without a human present. Whoever obtained that secret inherited the application’s permissions in every tenant that had granted them.
That architecture explains why the usual defenses did not fire. Multifactor authentication protects a person signing in. An app-only token is not a person, so there is no second factor to challenge, and the resulting activity appears in logs as the application doing its job. Directory reads through Graph can leave less evidence than an ordinary mailbox login, and Huntress cautioned that the absence of visible mail or file access does not establish that nothing was taken.
The reach of the permissions depends on what each customer consented to, and backup products ask for a lot because restoring a tenant requires reading all of it. Mail, files, chats, user and group objects and application registrations were all in scope somewhere. For a managed service provider, that is the whole customer relationship in one token.
A second application drew attention. Researchers found activity involving ConnectWise Cloud Management for Microsoft Teams, which in at least one tenant assigned itself the Global Administrator role and added new client secrets to other applications. Whether that was the same actor or an unrelated misconfiguration is not settled publicly. The technique, if it was deliberate, is the standard way to convert temporary access into a permanent foothold: escalate, then create credentials that survive a password reset.
The population affected is the part that makes this larger than the number suggests. ConnectWise sells to managed service providers, which sell to small and midsize businesses that have no security team and no way to audit an integration their IT vendor installed. A single compromised vendor credential therefore reaches thousands of organizations that never chose ConnectWise and may not know it holds a key to their mail. That is the concentration risk of the tooling layer, and it is the same risk that produced the attacks on remote monitoring software a few years ago.
Recovery is awkward in a way that is specific to backup. The product that restores a tenant is the product that has been switched off, and until ConnectWise issues an all-clear, administrators are being told to disable the service principal rather than delete it, so that the evidence survives. Backups have stopped, which means a gap in recovery points begins to accumulate from the moment access was cut. Emails, files and Teams keep working, so the outage is invisible until someone needs to restore something from last week.
Huntress advised administrators to review service principal sign-ins, role assignments and credentials added since October 13, and to look for unexpected Global Administrator grants. Microsoft’s detection team can pull directory telemetry beyond the standard retention window, which matters because the intrusion was short and the logs that would prove exfiltration may already be aging out.
The commercial context is a decade of consolidation in managed services tooling. ConnectWise, owned by Thoma Bravo since 2019, assembled a suite by acquisition, and each acquired product arrived with its own integration into customer systems. Integrations are sold as time savers: one console, one agent, one login. The cost is a standing grant of permission held by a third party, renewed silently every time an administrator clicks through a consent screen.
Legal exposure will be sorted out slowly. Notification obligations run from state breach statutes with different clocks, and the contracts between providers and their customers typically allocate responsibility for security without specifying who pays when a shared credential fails. Insurers will ask whether the customer had conditional access policies that would have blocked token issuance from an unfamiliar address, and many small businesses will find the answer is that nobody configured one.
The fix is not a patch. Secrets held by a vendor for use across thousands of tenants can be replaced with workload identity federation, tenant-level restrictions and policies that watch service principals the way they watch employees. Those controls exist and are unevenly deployed, because they cost engineering time and produce no visible feature. The alternative is what happened here: a key that worked everywhere, a window of hours, and a backup service that had to be turned off to stop the bleeding.
