INCIDENT REPORT · CP-2026-010

ConnectWise Cloud Backup Supply-Chain Compromise

L3 · ELEVATEDCONFIRMED

In mid-October 2026 an attacker used a compromised credential belonging to ConnectWise's Cloud Backup (formerly SkyKick) application to access Microsoft 365 tenants of managed-service providers and their customers without user sign-ins. Microsoft attributed the campaign to Storm-0940, a China-linked group, and said it targeted more than 2,250 tenants, most attempts unsuccessful.

Incident ID: CP-2026-010
Incident date: 15 OCT 2026
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Tampa, United States (Affected organization headquarters (ConnectWise); victims global)
Threat classification: Level 3 — ELEVATED
Classification rationale: State-linked supply-chain compromise of an MSP tool reaching thousands of cloud tenants across sectors.
Attack type: Supply-Chain Attack
Nature: Malicious activity
Attack vector: Stolen application credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 app, used to obtain Microsoft Graph access to customer tenants
Sectors: Technology
Critical infrastructure: No
Organizations affected: ConnectWise, Microsoft 365 customer tenants
Operational consequences: Security firm Huntress reported confirmed unauthorized access in roughly 160–175 Microsoft 365 tenants, with some service principals granting themselves Exchange Administrator roles. ConnectWise disabled the affected app identities, revoked certificates and suspended the Cloud Backup service before phased restoration.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by Microsoft to Storm-0940 (China-linked threat actor)

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

ConnectWise Cloud Backup Supply-Chain Compromise

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2026-010

Incident date

15 OCT 2026

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Tampa, United States (Affected organization headquarters (ConnectWise); victims global)

Threat classification

Level 3 — ELEVATED

Classification rationale

State-linked supply-chain compromise of an MSP tool reaching thousands of cloud tenants across sectors.

Attack type

Supply-Chain Attack

Nature

Malicious activity

Attack vector

Stolen application credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 app, used to obtain Microsoft Graph access to customer tenants

Sectors

Technology

Critical infrastructure

Organizations affected

ConnectWise, Microsoft 365 customer tenants

Operational consequences

Security firm Huntress reported confirmed unauthorized access in roughly 160–175 Microsoft 365 tenants, with some service principals granting themselves Exchange Administrator roles. ConnectWise disabled the affected app identities, revoked certificates and suspended the Cloud Backup service before phased restoration.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by Microsoft to Storm-0940 (China-linked threat actor)