Act
active
ConnectWise Cloud Backup breach compromises M365 tenants via app identities
- Engineer — Act: Organizations using ConnectWise Cloud Backup (formerly SkyKick) should immediately audit M365 OAuth application permissions and service principal activity for unauthorized delegated access; revoke any ConnectWise-related app registrations until the vendor confirms scope and remediation.
- SOC/IR — Act: Hunt M365 unified audit logs and Entra ID sign-in logs for anomalous OAuth app consent events or application identity authentications tied to ConnectWise/SkyKick since the compromise window; treat impacted tenants as assume-breach and sweep for mailbox rule creation, exfiltration signals, and new delegated permissions.
- Leader — Act: Confirm this week whether your organization or your MSP uses ConnectWise Cloud Backup, then request ConnectWise’s incident report and attestation of scope; assess whether compromised M365 tenant data triggers disclosure obligations under SEC, GDPR, or applicable state rules.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.