A Trusted Technology Provider Becomes a Security Risk
Businesses rely on Microsoft 365 every day to manage email, share documents, collaborate with employees, and store sensitive information. But even well-protected environments can face security risks through trusted third-party applications.
On October 17, 2026, The Hacker News reported that attackers had exploited compromised credentials associated with ConnectWise Cloud Backup, formerly SkyKick, to gain unauthorized access to Microsoft 365 customer environments.
Cybersecurity researchers at Huntress identified unauthorized sign-ins across 173 customer and partner tenants.
The incident highlights an important reality: Protecting your business requires securing not only your employees and devices, but also the applications and vendors connected to your systems.
What Happened?
ConnectWise Cloud Backup provides backup and recovery services for Microsoft 365 environments.
To perform these functions, the application may receive extensive permissions to access email, OneDrive, SharePoint, Teams, and directory information.
Attackers obtained a compromised application credential and used it to authenticate through Microsoft Graph, potentially accessing information through permissions that customers had previously authorized.
Unlike traditional attacks involving stolen employee passwords, this activity exploited an existing trusted application identity.
Researchers also observed suspicious administrative activity, including attempts to add credentials to other applications and expand access.
ConnectWise responded by suspending affected cloud services and initiating remediation. The company reported no evidence that its Cloud Backup archives had been compromised, although activity within individual customer environments requires separate investigation.
Why Small and Midsize Businesses Should Pay Attention
Many businesses assume that enabling multifactor authentication, deploying antivirus software, and using Microsoft 365 automatically provides comprehensive protection.
These technologies are important, but they do not address every cybersecurity risk.
Third-party applications often operate with permissions that allow them to access sensitive business information without requiring an employee to sign in.
If those application credentials are compromised, attackers may gain access to information that would otherwise be protected by traditional user authentication controls.
Potential consequences include:
Unauthorized access to company emails and confidential documents.
Exposure of customer, employee, or financial information.
Compromise of cloud applications and administrative privileges.
Operational disruption and increased recovery costs.
The actual impact depends on the permissions granted and the activity performed within each affected environment.
Five Steps Businesses Can Take to Improve Microsoft 365 Security
1. Review Third-Party Application Access
Identify applications connected to your Microsoft 365 environment. Verify that each integration is necessary and has only the permissions required to operate.
2. Strengthen Identity Security
Use multifactor authentication, Microsoft Entra Conditional Access, least-privilege permissions, and appropriate controls for privileged application identities.
3. Monitor Suspicious Cloud Activity
Review application sign-ins, administrative changes, unusual access patterns, and security alerts. Monitoring should include service identities, not just employee accounts.
4. Verify Backup and Recovery Readiness
Maintain a documented backup strategy and periodically test your ability to restore critical business information. Understand how vendor outages could affect recovery operations.
5. Conduct Regular Security Assessments
A proactive Microsoft 365 security assessment can identify unnecessary permissions, configuration weaknesses, and gaps in your organization's security controls.
What If Your Business Uses ConnectWise?
Organizations using ConnectWise Cloud Backup or related services should review official vendor security advisories and have their IT administrator investigate relevant Microsoft Entra ID activity.
Security teams should examine service principal sign-ins, unexpected application credential changes, and unusual administrative role assignments.
Microsoft and security researchers identified suspicious authentication activity associated with the incident beginning October 15, 2026.
Businesses should follow current vendor remediation guidance rather than making uncoordinated changes that could interfere with ongoing investigations or business operations.
How High-Value Tech Can Help
At High-Value Tech, we understand that small and midsize businesses need enterprise-level security without unnecessary complexity.
Our cybersecurity and managed IT services help organizations strengthen their technology environments through:
Microsoft 365 security and administration
Microsoft Entra ID identity and access management
Cloud security assessments
Endpoint protection and threat monitoring
Backup and disaster recovery planning
IT infrastructure and cybersecurity consulting
We focus on practical security improvements that reduce business risk while supporting productivity and operational continuity.
Whether your organization operates from a single office or multiple locations, High-Value Tech provides the expertise needed to develop a more secure and resilient technology environment.
Is Your Business Properly Protected?
The ConnectWise incident is a reminder that trusted technology integrations still require oversight.
Cybersecurity is not simply about installing security software. It requires understanding who and what can access your systems, monitoring for suspicious activity, and preparing your business to respond when threats emerge.
Protect your business before the next incident.
Contact High-Value Tech to discuss a Microsoft 365 security assessment or learn how our managed IT and cybersecurity services can support your organization.
High-Value Tech | Technology Fortified.
Website: https://highvaluetech.com
Email: info@highvaluetech.com
Phone: 314-346-0589
Source: The Hacker News, October 17, 2026 "Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants."
Comments