Our backup vendor was hacked. Is our Microsoft 365 safe?

The question

What we told them

First, the plain answer: if you never used that vendor's backup app, this attack did not come through your door. But the way it worked matters for everyone, so here is what happened.

On 17 Oct 2026, ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick. Attackers had taken the app's own credentials. BleepingComputer reported that Huntress had identified at least 162 compromised tenants. Sign-ins started at least on 15 Oct.

The attacker did not log in as a person. The script signed in as the backup application, using permissions customers had already granted it. Todyl said that is why MFA was ineffective: there was no user login to challenge. With those permissions, the app could read and write mail, OneDrive and SharePoint files, and Teams chats. In one tenant, Huntress saw the attacker set up persistence in about five minutes.

Here is our opinion. MFA protects people. It does not protect an app that your tenant trusts. Most small businesses have a list of connected apps they approved once and never looked at again. One admin reported a Microsoft alert on 15 Oct that an app unused for years had given itself the Exchange Administrator role.

Shutting the vendor down does not clean your tenant. Huntress says credentials already planted stay until you remove them. So the first job is a review, not a reaction. Open Entra, list the enterprise applications, and remove any you do not recognize or no longer use. Then check each remaining app for new secrets or certificates added since 13 Oct.

One more point. Those backups are paused, so confirm you have a second way to restore your mail and files.