Imagine handing your building's master key to a security contractor, and then that contractor gets pickpocketed. That's essentially what happened here. Threat actors obtained a single compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup — the platform formerly known as SkyKick — and used it to waltz into 173 separate M365 customer environments without triggering a single password prompt.

ConnectWise Cloud Backup is a backup and recovery tool built specifically for managed service providers (MSPs). MSPs are, by design, trusted to hold elevated access to dozens or hundreds of client tenants at once. That's the value proposition. It's also the attack surface.

What actually happened. The attackers didn't exploit a software vulnerability or write a single line of malware. They simply authenticated as ConnectWise. Once inside the ConnectWise service account, they had delegated administrative access to every tenant that had granted the backup service permission to touch their M365 data. At last count, 173 tenants had been accessed — and that number may still be moving.

The specific nature of the access is what makes this alarming. MSP tooling typically holds broad permissions: mailbox access, SharePoint, Teams, OneDrive. Whoever was in there could read email, exfiltrate files, or quietly establish persistent access via new accounts or OAuth tokens — all without the individual customer organisations ever seeing a suspicious login on their own tenancy.

Why MSPs keep being the target. This isn't the first MSP-as-pivot-point incident, and it won't be the last. The economics are compelling for attackers: compromise one supplier, inherit access to dozens of downstream targets. We saw the same playbook in the SolarWinds campaign, the Kaseya VSA ransomware attack, and a string of smaller incidents since. Each time, the lesson is the same — third-party trust relationships are a force multiplier, for defenders and attackers alike.

What to watch for. ConnectWise has not yet disclosed whether affected tenants have been notified, whether the initial credential was phished, bought on a dark web market, or obtained some other way. The "how" matters for defenders trying to understand their own exposure.

For Australian organisations, the implications are direct. The MSP model is the backbone of IT delivery for a vast swath of Australian small and medium businesses, and the ACSC's Essential Eight specifically calls out third-party access management as a control area. Under the SOCI Act, critical infrastructure entities using MSPs are required to assess and manage supply chain risk — incidents like this are exactly the scenario those obligations were written for.

What to do right now. If your organisation uses ConnectWise Cloud Backup — or any MSP tooling with delegated M365 access — this is the moment to pull your unified audit logs and look for unexpected sign-ins, new OAuth app registrations, or unfamiliar admin accounts. Don't wait for ConnectWise to notify you. Assume breach, verify clean.

The deeper lesson here is a familiar one: federated trust at scale is a liability until it's actively managed. One credential, 173 consequences.