ConnectWise Supply Chain Attack: What You Need to Know
A major ConnectWise supply chain attack has compromised Microsoft 365 tenants across multiple organisations, forcing the software vendor to shut down its Cloud Backup service entirely. This incident represents one of the most significant supply chain breaches of 2026, affecting businesses that rely on ConnectWise’s managed backup solutions for their critical cloud data.
Australian businesses using ConnectWise products or managed service providers (MSPs) that leverage this platform must act immediately. The attackers gained access to application identities, enabling them to infiltrate customer Microsoft 365 environments without triggering traditional security alerts.
“ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.”
What Happened in the ConnectWise Breach?
On October 18, 2026, ConnectWise confirmed that threat actors had successfully breached their Cloud Backup infrastructure. The attackers exploited vulnerabilities within the backup platform to access application identities — the credentials that allow ConnectWise’s service to interact with customer Microsoft 365 environments.
The Cloud Backup service, previously known as SkyKick Cloud Backup, is widely used by MSPs to protect their clients’ Microsoft 365 data. This makes the breach particularly devastating, as a single point of compromise has cascaded across potentially thousands of downstream organisations.
Timeline of Events
- Initial compromise: Attackers gained access to ConnectWise Cloud Backup infrastructure
- Lateral movement: Threat actors extracted application identities and OAuth tokens
- Tenant compromise: Hackers used stolen credentials to access customer Microsoft 365 environments
- Service shutdown: ConnectWise disabled Cloud Backup access to contain the breach
How Does This Supply Chain Attack Work?
Supply chain attacks target trusted third-party vendors rather than attacking organisations directly. In this ConnectWise supply chain attack, the threat actors exploited the inherent trust relationship between the backup service and Microsoft 365 tenants.
When organisations configure Cloud Backup, they grant the application specific permissions to access their Microsoft 365 data. These permissions are authenticated through OAuth application identities, which function as persistent access tokens.
Technical Attack Vector
- Attackers compromised ConnectWise’s backup infrastructure
- They extracted stored application credentials and OAuth tokens
- Using these credentials, they authenticated directly to customer Microsoft 365 tenants
- The access appeared legitimate because it came from an authorised application
This technique bypasses many traditional security controls, including multi-factor authentication (MFA), because the application identity was already authorised to access tenant resources.
Business Impact for Australian Organisations
The ramifications of this breach extend far beyond immediate data exposure. Australian businesses face several critical risks following this ConnectWise supply chain attack.
Immediate Risks
- Data exfiltration: Attackers may have accessed emails, SharePoint files, OneDrive documents, and Teams conversations
- Business email compromise: Threat actors could use access to launch phishing attacks or conduct fraud
- Ransomware deployment: Compromised tenants may be targeted for subsequent ransomware attacks
- Compliance violations: Breached data may trigger notification requirements under the Australian Privacy Act
Long-Term Consequences
Organisations affected by this breach may face regulatory scrutiny from the Office of the Australian Information Commissioner (OAIC). The Notifiable Data Breaches scheme requires organisations to report breaches likely to result in serious harm within 30 days.
Additionally, businesses must consider the reputational damage and potential loss of customer trust. If you’re unsure whether your organisation has been affected, speak with our security team for an immediate assessment.
Actionable Security Recommendations
Organisations using ConnectWise Cloud Backup or similar third-party backup solutions must take immediate defensive action. The following steps will help contain potential damage and prevent future supply chain compromises.
Immediate Actions
- Audit application permissions: Review all third-party applications with access to your Microsoft 365 tenant
- Revoke suspicious tokens: Remove OAuth permissions for ConnectWise applications immediately
- Review sign-in logs: Check Azure AD sign-in logs for unusual application activity
- Enable conditional access: Implement location and device-based restrictions for application access
- Monitor for indicators of compromise: Watch for unusual mailbox rules, forwarding changes, or data exports
Long-Term Security Improvements
- Implement a zero-trust architecture that validates every access request
- Deploy Microsoft Defender for Cloud Apps to monitor third-party application behaviour
- Establish vendor security assessment processes before granting tenant access
- Consider vulnerability management services to identify and remediate security gaps
- Develop incident response playbooks specifically for supply chain compromise scenarios
Frequently Asked Questions
What is a supply chain attack?
A supply chain attack occurs when threat actors compromise a trusted third-party vendor to gain access to their customers’ systems. Rather than attacking organisations directly, hackers target the software, services, or infrastructure that organisations depend upon. This ConnectWise supply chain attack demonstrates how a single vendor compromise can affect thousands of downstream businesses.
How can I check if my Microsoft 365 tenant was compromised?
Start by reviewing your Azure Active Directory sign-in logs for any unusual application authentications. Look for access from unexpected locations, unusual times, or unfamiliar IP addresses. Additionally, audit your enterprise applications in Azure AD to identify any suspicious permissions. Microsoft’s Unified Audit Log can reveal data access patterns that may indicate compromise.
How can Australian businesses protect against future supply chain attacks?
Implement strict vendor assessment procedures before granting any third-party application access to your environment. Use conditional access policies to restrict application permissions based on risk signals. Regularly audit and review all OAuth applications with tenant access, and maintain robust monitoring to detect anomalous behaviour quickly. Consider engaging a cybersecurity partner to conduct regular supply chain risk assessments.
Key Takeaways
- ConnectWise Cloud Backup (formerly SkyKick) has been compromised, affecting Microsoft 365 tenants globally
- Attackers exploited application identities to bypass traditional authentication controls
- Australian organisations must immediately audit third-party application permissions
- This incident highlights the critical importance of supply chain security in cloud environments
- Affected businesses may have notification obligations under Australian privacy legislation
Conclusion: Strengthening Your Supply Chain Security
The ConnectWise supply chain attack serves as a stark reminder that your security is only as strong as your weakest vendor. As organisations increasingly rely on third-party cloud services, the attack surface expands beyond traditional network boundaries.
Australian businesses must prioritise vendor risk management and implement robust controls around third-party application access. Regular security assessments, continuous monitoring, and incident response planning are no longer optional — they’re essential components of modern cybersecurity posture.
If your organisation uses ConnectWise products or you’re concerned about your supply chain security posture, don’t wait for a breach to take action. Contact OziTechs today to assess your exposure and implement protective measures before threat actors exploit your trusted vendor relationships.