The incident
On 16 October 2026, ConnectWise confirmed unauthorised access involving its Cloud Backup service, formerly SkyKick.
A compromised application credential was used in attempts to access customer Microsoft 365 environments. Because the application supports backups across Exchange Online, OneDrive, SharePoint and Teams, the incident required an immediate and thorough response.
This was a third-party vendor incident, not a vulnerability in Microsoft 365 or in customers’ own systems.
Fuse’s response
Fuse began investigating when the first security warnings emerged, ahead of ConnectWise’s official advisory.
Our security team:
- Disabled the affected Cloud Backup application in the Fuse environment and relevant client environments
- Reviewed service-principal sign-ins, audit records, mailbox activity and file activity
- Searched for activity associated with the known attacker infrastructure and compromised application
- Checked applications for unauthorised credentials that could provide ongoing access
- Assessed the impact on affected environments and communicated directly with clients
This approach went beyond waiting for the vendor to resolve the issue. We independently examined what the incident meant for each relevant environment.
What we found
For transparency, the Fuse tenant recorded one authentication event involving the compromised application on 15 October.
Our investigation found:
- No data was accessed
- No data or configuration was changed
- No ongoing unauthorised access
- No evidence that the issued access token was used
Backup impact
As a precaution, ConnectWise disabled Cloud Backup application access worldwide.
While the service was offline, new Microsoft 365 backups were paused and restores were unavailable. ConnectWise reported that existing backup archives remained intact and that it had found no evidence of compromised backup data.
The lesson for business leaders
Organisations depend on third-party platforms to support their operations. But when one of those providers is compromised, waiting for a vendor update is not an incident response strategy.
Businesses need an IT and security partner that can:
- Act quickly to contain potential exposure
- Investigate the organisation’s own environment
- Look beyond the original entry point for ongoing access
- Assess the operational and data impact
- Communicate findings clearly and transparently
A cyber incident may begin with a third party. Responsibility for protecting the business cannot be outsourced.
Is your business prepared for a cyber incident involving one of its trusted technology providers?
Speak with Fuse Technology about strengthening your third-party risk management, Microsoft 365 security and incident readiness.
Request a comprehensive cybersecurity assessment
The Fuse Cybersecurity Assessment will provide you with an in-depth look at your organisation’s current cyber security posture.
We will evaluate your organisation’s ability to detect, contain and respond to threats and review your processes in place for identifying vulnerabilities within your infrastructure.