ConnectWise and the hidden risk in Microsoft 365 backups.
The ConnectWise Cloud Backup compromise shows why the safest secret is the one that no longer exists.
On October 15, a script worked through a sorted list of Microsoft 365 tenants, presenting one credential to Microsoft Entra ID every few seconds and requesting an access token for each. The credential belonged to ConnectWise Cloud Backup, formerly SkyKick, and it worked wherever an organization had approved the app. No password was guessed and no MFA prompt appeared, because the script was signing in as the backup application itself.
One credential, every tenant
That works because ConnectWise Cloud Backup is a multi-tenant application. Administrators who enable it grant the app access to mailboxes, OneDrive, SharePoint, Teams, and directory data without a user signed in. The vendor holds the one credential that proves the app's identity in every consenting tenant.
Because the sign-ins were app-only, Conditional Access policies written for users never applied either. Huntress confirmed unauthorized sign-ins in 162 tenants by October 16. A later review found sign-in activity from the attacker's IP address across nearly 1,000 tenants, with more than 300 successful sign-ins. Some attempts failed because the app was not installed in the targeted tenant. Microsoft called it an active supply chain attack.
ConnectWise disabled seven application identities on October 17, suspended Cloud Backup along with SaaS Security and Cloud Management, and is now resetting accounts and replacing application credentials. How the credential was exposed remains under analysis, and no threat actor has been named.
What a backup app can see
Shutting off the connection stops new sign-ins but says nothing about what the attacker reached while inside. A backup service has to read everything so it can copy everything. That requirement is legitimate, and it is what made this credential so valuable. Whoever held it inherited the app's reach into every mailbox, SharePoint site, and Teams chat.
Investigators have confirmed unauthorized access but not exactly what was taken. Huntress notes that directory reads through Microsoft Graph leave no audit record, and Todyl could not separate attacker reads from legitimate backup traffic. ConnectWise reports no evidence that its stored backup archives were accessed, but that does not rule out exposure within live Microsoft 365 environments. Todyl's guidance: treat that data as exposed.
That raises an uncomfortable question for every affected organization. What is actually in there? For most businesses, mail and chat history holds years of ordinary conversation, including temporary passwords sent during onboarding, Wi-Fi keys dropped into a Teams thread, API keys emailed to a contractor, and the scanned ID someone attached to verify a payroll change. Most of it was shared to finish an ordinary task. The task ended, but the information stayed. A tool with tenant-wide read access treats all of it as one searchable archive.
Threads without passwords still carry value. An old support conversation might show who approves account resets, which MSP handles them, and the process employees expect to follow. That context makes a fraudulent request far more convincing, even without a stolen credential.
The cleanup is its own attack surface
Historical data is only part of the problem. Disabling the apps does not reverse changes already made inside a tenant, as ConnectWise has said, so organizations must still determine whether the attacker created another way in. In two tenants Huntress investigated, a ConnectWise application granted itself Global Administrator and planted new client secrets on other trusted applications, in one case set to expire in 2028. Huntress has not tied that activity to the operator behind the sign-in sweep. Those secrets stay usable after the vendor credential is revoked until someone removes them.
Remediation means reviewing credentials on every application, removing roles nobody intended to grant, rotating secrets, and keeping the ConnectWise apps disabled until the vendor issues formal restoration instructions. MSPs managing many clients now face a surge of new secrets, admin resets, and urgent requests, many of them moving through email and Teams. Every new secret pasted into those conversations recreates the same long-term exposure organizations are trying to contain.
The scramble also creates ideal cover for impersonation. A caller claiming to be the MSP and asking for a quick approval sounds routine this week. So does a client "administrator" asking for an emergency reset. The public disruption alone gives an impersonator a convincing reason to make contact.
Where Traceless fits
Closing the original door is work for ConnectWise and its customers: rotating compromised vendor credentials, reviewing application permissions, removing dormant SkyKick connections, and monitoring service principal activity in Entra. Traceless does not rotate OAuth secrets or govern application consent. What it changes is how much remains within reach when trusted access is abused, and how easily someone can impersonate a trusted party during cleanup.
Traceless Data replaces the pasted password and the emailed key with an encrypted, expiring link sent from inside the ticket or Teams chat. Once the link is used or expires, the credential is no longer sitting in a ticket, email, or chat history for someone to discover months later.
Traceless Verify addresses the impersonation window. Before a technician resets an admin account or approves an application change, either side can trigger on-demand, bidirectional identity verification through the organization's existing MFA tools. Each side confirms the other is real, and the exchange leaves an audit trail.
Every integration an organization approves is a standing grant that someone else could inherit. Customers have limited visibility into how vendors protect the credentials they hold, but every organization can control what sits inside the reach of that grant. Least privilege limits what a trusted app can touch, and least persistence limits what it finds when it gets there.
Prevent social engineering attacks
Start with one integration, validate quickly, and expand across your environment.