Is ConnectWise Cloud Backup the same as SkyKick?
Yes. ConnectWise acquired SkyKick in 2024 and the backup product now goes by ConnectWise Cloud Backup. You may still see the SkyKick name in your Microsoft 365 tenant.
8 minutes reading time
(1664 words)
ConnectWise Cloud Backup (Formerly SkyKick) Incident: What MSP Clients Should Check Today
We've spent years telling clients that backups are the safety net. If everything else goes wrong, you can get your data back. So, it stings a bit to write a post about a backup platform possibly being the way an attacker got into Microsoft 365.
On October 16, 2026, ConnectWise said it is investigating unauthorized access activity involving ConnectWise Cloud Backup, the Microsoft 365 backup product many of you still know as SkyKick. The same day, the security firm Huntress posted a rapid response saying it had confirmed that an unknown threat actor used access gained in SkyKick to pivot into customers' Microsoft 365 environments.
This is early. Things will change over the next few days. But if your business, or your IT provider, uses this product, there are a few things worth doing right now rather than waiting for the final report.
What We Know So Far
Here's where things stand as of this writing. We're keeping the vendor's statements, and the third-party reports separate on purpose, because right now they don't fully line up.
What ConnectWise has said- It detected suspicious authentication activity tied to the Cloud Backup service.
- Containment measures are in place.
- It has "no current evidence that partner backup data has been accessed."
- The investigation is ongoing and updates will follow.
- Huntress called it a widespread security incident and said it confirmed the attacker abused SkyKick access to reach customers' Microsoft 365 tenants.
- Community researchers (including a post attributed to Blackpoint Cyber) shared two indicators to look for: the enterprise application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and the IP address 144.172.64.128.
- Those same researchers were clear that just having the app in your tenant does not mean you were compromised. Plenty of organizations have it installed because they use the product.
A Quick Bit of Background
SkyKick was a Seattle company that built cloud backup and management tools for IT providers. ConnectWise announced it was acquiring SkyKick (along with Axcient) on September 10, 2024, and the backup product was later rebranded as ConnectWise Cloud Backup. It's sold almost entirely through MSPs, which means a lot of small and mid-sized businesses use it without ever having logged into it themselves.
If you're not sure whether you're one of them, that's normal. Ask your IT provider. (If we're your IT provider, we'll be reaching out directly.)
Why a Backup Tool Is Such a Big Deal
Think about what a Microsoft 365 backup product has to do. It needs to read every mailbox, every OneDrive, every SharePoint site and Teams file, and in newer versions your Entra ID configuration too. To do that, it gets installed in your tenant as an enterprise application with broad permissions that a normal user would never have. That's fine when the vendor is the only one using that access. It's a real problem when someone else gets hold of it.
One trusted app, many tenants. That's what makes this kind of incident hard
This is the same pattern we've seen with remote management tools and other MSP software over the last few years. Attackers don't have to break into 500 businesses one by one if they can get into the one tool all 500 trust. Security folks call it a supply chain or third-party attack. We just call it a bad week.
It also doesn't trip the usual alarms. There's no phishing email, no weird login from a user account, and MFA doesn't come into play because apps sign in with their own credentials. The activity can look like the backup app doing its normal job.
What to Check Today
You don't need to wait for the final incident report to take a look. If you manage your own Microsoft 365 tenant (or want to double-check your provider's work), start here:
Start with the app and the sign-in logs. Those two answer most of the question
- Confirm whether the app is in your tenant. In the Microsoft Entra admin center, go to Enterprise applications and look for ConnectWise Cloud Backup / SkyKick, or search for the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
- Check sign-in activity for that app. Review service principal sign-ins for any activity from 144.172.64.128 or other addresses that don't match what you'd expect. Go back as far as your logs allow.
- Look for follow-on activity. In the unified audit log, watch for unusual mailbox access, new inbox forwarding rules, new app registrations or consents, and changes to admin roles.
- Review the app's permissions. Make sure what it's been granted lines up with what a backup product needs. If something looks broader than it should be, flag it.
- Make a decision about the app and plan for the tradeoff. Some researchers suggest temporarily disabling the enterprise application. That cuts off the access, but it also stops your backups. If you go that route, make sure you have another copy of critical data and a plan to turn it back on.
- Rotate what makes sense. If you find suspicious activity, treat it like a compromise: revoke sessions, reset affected credentials, and bring in your incident response team.
- Keep an eye on official updates. Watch the ConnectWise Trust Center and your MSP's communications for confirmed scope and any additional indicators.
The Bigger Lesson for Business Owners
We'll be blunt. Most businesses have no idea how many third-party apps have access to their Microsoft 365 tenant. Backup tools, e-signature apps, CRMs, scheduling tools, that one add-in somebody approved in 2021. Each one is a door, and some of them have keys to every room.
A few habits go a long way:
- Inventory your enterprise apps at least quarterly and remove what you don't use.
- Follow least privilege. Apps should get only the permissions they actually need.
- Keep more than one copy of your data. A backup that only exists inside one vendor's platform isn't a full plan. The old 3-2-1 rule still holds up.
- Ask your vendors (and your MSP) hard questions. How do they secure the access they hold into your tenant? How fast will they tell you if something goes wrong?
None of this means you should rip out your backup solution tomorrow. Backups are still essential. It just means the tools we trust most deserve the closest look.
How LBT Technology Group Can Help
If you use ConnectWise Cloud Backup / SkyKick, or you just aren't sure, LBT Technology Group, LLC can review your Microsoft 365 tenant for the indicators above, audit which third-party apps have access, and help you set up a backup plan that doesn't hinge on a single vendor. Contact our team and we'll take a look with you.
The Bottom Line
ConnectWise says it's investigating and hasn't seen evidence that backup data was accessed. Huntress says the attacker used SkyKick access to get into customer Microsoft 365 environments. Until that gap is closed, assume the second one could apply to you, check your tenant, and keep an eye on updates. We'll update this post as more comes out.
Frequently Asked Questions
If the app is in our tenant, were we hacked?
Not necessarily. Researchers have been clear that the app being present isn't proof of a compromise. What matters is the sign-in and audit activity tied to it.
Was our backup data stolen?
ConnectWise says it has no current evidence that partner backup data was accessed. The bigger concern raised by researchers is access to live Microsoft 365 environments, so that's where we'd look first.
Should we turn off the backup app?
It depends on what you find and your risk tolerance. Disabling the enterprise application cuts off access but also stops backups. Talk with your IT provider before making that call and make sure you have another copy of important data.
We don't manage our own Microsoft 365. What should we ask our IT provider?
Ask whether you use ConnectWise Cloud Backup / SkyKick, whether they've checked your tenant for the published indicators, what they found, and what their plan is if the app needs to be disabled.
Sources & Further Reading
- Huntress (@HuntressLabs) on X — Rapid Response: ConnectWise Cloud Backup (formerly SkyKick) incident, October 16, 2026: https://x.com/HuntressLabs/status/2111170005433815225
⚠️ Urgent threat notice | Threat Radar
ConnectWise is investigating unauthorized access attempts involving its Cloud Backup service, formerly SkyKick, which integrates with Microsoft 365…
ConnectWise Accelerates Next Generation of Data Protection and Cybersecurity for MSPs with Acquisitions of Axcient and SkyKick | ConnectWise
Tampa, FL, September 10, 2024 - ConnectWise is acquiring Axcient and SkyKick to enhance MSP cybersecurity and data protection against ransomware and phishing.
Trust Center | Advisories | ConnectWise
Communications on broader security related topics that may not be linked to a specific ConnectWise product or vulnerability, but are still of importance to our partner community.
