Published: October 17, 2026 · Last updated: October 17, 2026
A single compromised login at backup vendor ConnectWise’s SkyKick gave attackers access to 173 separate companies’ Microsoft 365 accounts at once, forcing a shutdown of cloud backup services while the breach was investigated.
A single compromised login at a backup vendor was enough to reach into 173 separate companies’ Microsoft 365 environments this week, in one of the clearer demonstrations yet of how exposed the managed IT services supply chain really is. The vendor is ConnectWise’s SkyKick, a cloud backup product widely resold by IT service providers to small and midsize businesses that do not run their own in-house security teams.
According to researchers tracking the incident, attackers obtained a valid credential tied to SkyKick’s backend access into customer Microsoft 365 tenants, the kind of privileged access backup vendors need to actually back anything up. With that single credential, they were able to sign into 173 separate Microsoft 365 tenants without needing to individually compromise each one. ConnectWise responded by disabling the affected backup services entirely while it investigated, which meant customers lost the ability to run or restore cloud backups during the shutdown, on top of the breach itself.
This is the structural problem with backup and IT management vendors as a category: they exist specifically to hold broad, privileged access across many customers at once, because that is what the job requires. A helpdesk tool, a remote monitoring agent, or a backup service needs deep access to work at all. That same design is exactly what makes a single compromised vendor credential so disproportionately damaging. One login did not just expose one company’s data, it potentially exposed the backups of every small business that happened to use the same reseller relationship.
It is also not an isolated case. Managed service provider tooling has been a favored target for intrusion groups for several years now, precisely because compromising one vendor can open a path into dozens or hundreds of their downstream customers at once, most of whom have never heard of the vendor by name and have no direct way to monitor it. Security researchers have been warning about this exact failure mode well before this week’s incident, usually to limited public attention until something like this actually happens.
ConnectWise has not yet published a full account of how the credential was obtained, whether multi-factor authentication was in place on the compromised account, or what data, if any, attackers accessed before access was cut off. Affected customers are being notified individually, and backup services are reportedly being restored in phases rather than all at once, to allow for security review of each tenant before it is reconnected.
For the small businesses caught in the middle, the practical lesson is an uncomfortable one: picking a backup vendor is also picking a security posture you do not control and usually cannot audit. Asking a managed service provider directly how vendor credentials are stored, rotated, and monitored is no longer a question only security professionals need to ask.
Related: another story this week about a tech product doing more than its owner expected it to and why Big Tech keeps hiring specialists to manage exactly this kind of fallout.
Bottom Line: The weakest link in your security is rarely your own password policy anymore, it is the vendor three layers removed from you who happens to hold a master key. That is worth asking about before the next incident, not after.
Follow Teck Hustlers: Facebook · X · Instagram · LinkedIn · TikTok · Pinterest
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
