# ConnectWise Cloud Backup supply chain attack > Live situation record from CLSTR: https://clstr.news/situations/connectwise-cloud-backup-supply-chain-attack > Updated: 2026-10-22T21:08:00.000Z. Sources: 19. Developments: 3. A supply chain attack targeting ConnectWise Cloud Backup, formerly known as SkyKick, has compromised numerous Microsoft 365 tenants. Attackers compromised the OAuth application for the service to steal access tokens, allowing unauthorized access to mailboxes, OneDrive, SharePoint, Teams, and directory data. Microsoft confirmed malicious activity involving unauthorized authentication attempts, noting that attackers have been adding credentials for the service principal to compromised environments to maintain persistent access. Cybersecurity firm Huntress reported identifying at least 162 to 173 compromised organizations, though activity from the attacker’s address may have reached nearly 1,000 tenants. The intrusion utilized a client assertion credential residing within the vendor’s own tenant, which allowed attackers to effectively bypass multi-factor authentication (MFA) by exploiting a trusted application identity rather than individual user accounts. In response, ConnectWise has suspended several cloud services, including Cloud Backup, SaaS Security, and Cloud Management, to implement mitigations. This suspension impacts scheduled backups, archive access, restores, and license management. While ConnectWise stated there is currently no evidence that stored backups were accessed, the service halt means customers are temporarily unable to perform data restorations. ConnectWise has revoked the compromised certificates and cancelled the affected credentials. The company has engaged a third-party incident response firm to assist in the investigation and has shared relevant IP addresses and guidance to help managed service providers (MSPs) review their Microsoft 365 environments. Recent developments indicate the scale of the breach may be significantly larger than initially reported. Microsoft security researchers have identified that state-sponsored hackers from China targeted approximately 2,250 organizations. The attackers reportedly utilized AI agents to automate access attempts at a rate of nearly 3,000 connections per minute, a high cadence intended to saturate security team reaction times and bypass traditional detection. ## Claims - Security firm Huntress confirmed unauthorized sign-ins in at least 162 to 173 Microsoft 365 tenants. (corroborated by 6 sources) - Huntress later identified nearly 1,000 tenants showing activity from the attacker’s address. (corroborated by 2 sources) - Microsoft identified the incident as a supply chain attack involving the compromise of a trusted OAuth application. (corroborated by 2 sources) - ConnectWise stated there is no evidence that stored backups were accessed during the breach. (corroborated by 2 sources) - The attackers used the stolen credential to bypass multi-factor authentication (MFA) by signing in as an application rather than a user. (corroborated by 2 sources) - ConnectWise suspended its Cloud Backup service and took SaaS Security and Cloud Management offline to mitigate the incident. (single source) - Attackers added credentials for the service principal to compromised environments to maintain persistent access. (single source) - The company has engaged a third-party incident response firm to assist with the investigation. (single source) ## Timeline ### 2026-10-22: Chinese hackers target thousands of companies via ConnectWise breach Chinese state-sponsored hackers used AI to automate a massive breach of ConnectWise cloud services, targeting 2,250 organizations by stealing credentials to access Microsoft environments. 3 sources. https://clstr.news/cluster/chinese-hackers-target-thousands-of-companies-via-connectwise-breach ### 2026-10-20: ConnectWise suspends cloud services following Microsoft 365 cyberattack ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after a cyberattack exploited application identities to access at least 162 Microsoft 365 tenants. 5 sources. https://clstr.news/cluster/connectwise-suspends-cloud-services-following-microsoft-365-cyberattack ### 2026-10-17: ConnectWise suspends Cloud Backup service after Microsoft 365 credential breach ConnectWise suspended its Cloud Backup service after a supply chain attack used stolen application credentials to access hundreds of Microsoft 365 tenants, bypassing MFA via OAuth exploitation. 10 sources. https://clstr.news/cluster/connectwise-cloud-backup-breach-compromises-microsoft-365-tenants --- Cite as: ConnectWise Cloud Backup supply chain attack. CLSTR, https://clstr.news/situations/connectwise-cloud-backup-supply-chain-attack