- Engineer — Act: Organizations using ConnectWise Cloud Backup (formerly SkyKick) should immediately audit M365 OAuth application permissions and service principal activity for unauthorized delegated access; revoke any ConnectWise-related app registrations until the vendor confirms scope and remediation.
- SOC/IR — Act: Hunt M365 unified audit logs and Entra ID sign-in logs for anomalous OAuth app consent events or application identity authentications tied to ConnectWise/SkyKick since the compromise window; treat impacted tenants as assume-breach and sweep for mailbox rule creation, exfiltration signals, and new delegated permissions.
- Leader — Act: Confirm this week whether your organization or your MSP uses ConnectWise Cloud Backup, then request ConnectWise’s incident report and attestation of scope; assess whether compromised M365 tenant data triggers disclosure obligations under SEC, GDPR, or applicable state rules.