On October 15, 2026, attackers used a single stolen application credential from ConnectWise’s SkyKick cloud backup service to sign into 173 Microsoft 365 tenants. No employee clicked a phishing link. No one handed over a password. The breach happened through a third-party vendor application that had been granted privileged access to customers’ environments, no human manipulation required.
This is the gap that most insider threat awareness programs miss entirely. Organisations train employees to resist social engineering, monitor for unusual account behaviour, and report suspicious emails. What they rarely cover is the elevated access their cloud backup, endpoint management, and productivity tools hold as a matter of routine, and what happens when those credentials are stolen.
For organisations working toward a security awareness program that actually changes behaviour, this incident is a reminder that the scope of human risk includes every third party holding the keys to your systems, not only the employees sitting at desks.
How a Single Vendor Credential Unlocked 173 Organisations
ConnectWise’s SkyKick backup application had been granted highly privileged access to customer Microsoft 365 environments as part of its normal function, including Directory.ReadWrite.All permissions. When an attacker obtained a vendor-side application credential, they could authenticate directly against Microsoft 365 without triggering any multi-factor authentication challenge. MFA was simply not in play: the attacker used an application identity, not a human one, so no prompt was ever generated.
Security researchers at Huntress first confirmed unauthorised sign-ins across 162 tenants, then found that closer to 1,000 tenants showed activity originating from the attacker’s IP address, 144.172.64.128, on October 15. Researchers at SpecterOps published guidance on October 17 identifying the specific application ID and noting that the attacker had attempted to register additional credentials against the compromised service principal, a technique for maintaining access even after the original credential is cancelled. ConnectWise cancelled the credential on October 15 and found no evidence that stored backup data was exfiltrated, though restoration services were unavailable while the investigation continued.
Why Privileged Vendor Access Creates Cascading Risk
Once attackers have read access to a company’s email history, documents, and collaboration channels, they can execute business email compromise without ever directly interacting with an employee. They can review months of correspondence, map payment approval workflows, identify the right finance contacts, and time a fraudulent wire transfer request to coincide with a real invoice cycle, all from data they already hold.
Coalition’s research, published in October 2026, reported that business email compromise insurance claims jumped 30 percent since late 2025, with the increase tied directly to AI-assisted tooling capable of automating the reconnaissance and social engineering steps that previously required hours of manual effort. The average BEC claim remained below $30,000 per incident, according to Coalition, though NetDiligence has documented individual claims reaching $30 million. Passive mailbox access of the kind a vendor credential breach creates is precisely what enables that scale.
Three Steps to Strengthen Your Vendor Access Posture
Any organisation using ConnectWise SkyKick Cloud Backup should take three immediate actions. First, review service principal sign-ins in your Microsoft 365 admin centre and flag any authentication from unrecognised IP addresses, particularly 144.172.64.128. Second, audit active OAuth application grants in your Azure AD and examine which applications hold Directory.ReadWrite.All or similarly broad permissions. Third, disable or remove SkyKick-related application registrations in your tenant until ConnectWise confirms the service is fully secured.
More broadly, this incident argues for knowing your gaps before attackers do by mapping every third-party application and the exact permissions you have granted it inside your cloud environment. Most organisations have no current inventory of what their backup, endpoint management, or productivity tools are actually authorised to read and write. That inventory is not a nice-to-have; it is the prerequisite for catching an incident like this one before an attacker turns mailbox access into a fraudulent payment instruction.
For organisations without a dedicated security leader, strategic cybersecurity guidance without a full-time hire can provide the oversight needed to govern third-party application access on a recurring basis, before a breach makes it urgent.
In our work with Canadian organizations, we consistently see that vendor and supply chain compromises catch security teams off guard because the training and awareness investment stops at the perimeter of the organization itself. Stories like this one are a reminder that human risk extends to every third party with access. The most important conversation we have after incidents like this is not about the technology: it is about why the backup application’s access had never been reviewed before the attacker reviewed it first.
Sources
- The Hacker News, “Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants,” October 2026
- Huntress, “ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks,” October 2026
- SpecterOps, “ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant,” October 17, 2026
- Risk & Insurance, “Business Email Compromise Claims Jump 30% as A.I. Reshapes Cyber Risk,” October 2026
