Swiss SME Cyber Alert: ConnectWise/SkyKick Cloud Backup – check Microsoft 365 now
Updated: 2 days ago
Update – 21 October 2026: ConnectWise says it completed a full reset of all accounts and credentials in the affected Cloud Backup environment on 19 October and is preparing a phased restoration. As of 21 October, Cloud Backup, SaaS Security and Cloud Management remain suspended. Each potentially affected Microsoft 365 tenant still requires review, and the affected application connections must remain disabled until ConnectWise issues formal re-enablement instructions.
ConnectWise has confirmed unauthorised access to application identities associated with Cloud Backup, formerly SkyKick, for Microsoft 365. Stored backup archives remain encrypted and isolated, but the vendor cannot determine whether individual live Microsoft 365 environments were affected. If your IT provider uses this backup service, ask it to review your tenant today and preserve the available logs.
What happened?
ConnectWise disabled the affected connections and temporarily suspended Cloud Backup, SaaS Security and Cloud Management. Scheduled backups, archive access and restores are currently unavailable. Since containment began on 17 October 2026 at 05:00 UTC, ConnectWise has not observed successful threat activity in the environments it monitors. This does not establish that every individual customer tenant was unaffected.
Could my business be affected?
Businesses may be affected if their Microsoft 365 backup is provided directly or through an IT provider using ConnectWise Cloud Backup or SkyKick. Dormant and older SkyKick connections must also be considered. If the product name is unfamiliar, ask your IT provider specifically about ConnectWise Cloud Backup, SkyKick Cloud Backup or SkyKick Cloud Manager.
What should you do now?
Identify whether any affected ConnectWise or SkyKick application is present in your Microsoft 365 tenant, and keep it disabled until formal restoration guidance is issued.
Preserve Entra and Microsoft 365 sign-in and audit records immediately; short retention periods make this time-sensitive.
Review application access, new credentials, federation trusts, roles, consent grants, policy changes, mailbox forwarding, inbox rules and transport rules.
Document the last successful recovery point and the protection gap while the service is unavailable; confirm a temporary backup and recovery plan.
Do not reconnect affected applications until ConnectWise provides formal restoration instructions.
How urgent is it?
High – arrange the review today. This is confirmed unauthorised access to application identities used by a Microsoft 365 backup service. The backup archives are not currently believed to be compromised, but only a tenant-level investigation can identify suspicious changes or additional access paths.
Information for your IT provider
ConnectWise recommends reviewing the MSP tenant and every managed customer tenant, including dormant SkyKick connections. Key details are:
Review period: 13 October 2026 to the present; extend back to 1 October 2026 where logs are available.
Suspicious IP address: 144.172.64.128. A match requires investigation but is not, by itself, proof of compromise.
Observed user agents: Python-urllib/3.12 and python-requests/2.31. These indicators are not proof on their own.
The seven application identities disabled on 17 October 2026 at 07:00 UTC are listed below.
ConnectWise Cloud Backup — 506e08f9-6e9a-4da4-942b-a099a03644ae
ConnectWise Cloud Management — 2399d300-6fca-4e6a-a686-399fefe75b83
Cloud Management - MS Teams — 24205314-2b89-4e07-a2a4-579e898a5640
Cloud Management - Exchange Online — b78f6a77-d4e5-46fb-87e5-d1648bd02519
Cloud Management - MS Graph — 0de14c77-b9b0-4137-9360-34878a929827
Cloud Management - Partner Center — 412dcf96-176d-4b3a-a1b0-4981ad66971e
Cloud Management - SharePoint Online — b2b55f5b-7758-4719-8d8f-88ae172e6bdb
