Do we use ConnectWise Cloud Backup or the former SkyKick service?
Your provider should be able to confirm which service protects your Microsoft 365 data.
Microsoft 365 security alert
ConnectWise Cloud Backup security incident: is your Microsoft 365 data at risk?
The recent incident affecting ConnectWise Cloud Backup, formerly SkyKick, demonstrates why trusted SaaS applications need monitoring just as much as employee accounts.
What has happened
A trusted application can be a route to Microsoft 365, without Microsoft 365 itself being compromised.
Many organisations use a third-party backup service to protect Microsoft 365. But what happens if the service trusted to protect your data becomes the route an attacker uses to access it?
ConnectWise Cloud Backup, previously known as SkyKick, is used by organisations and IT providers to protect Microsoft 365 data including Exchange, SharePoint, OneDrive and Teams. A recent security incident involved unauthorised access to application identities associated with the service's access to customer Microsoft 365 environments.
This is different from an employee password being stolen, a phishing email or Microsoft 365 itself being compromised. A trusted application already has its own identity and approved permissions. If that identity is compromised, the investigation needs to understand exactly what it could reach in each tenant.
“The incident concerned a trusted application identity with approved permissions. Application-identity monitoring matters alongside user-sign-in monitoring.”
The trust path to understand
Microsoft 365
Backup service
Approved application access
Exchange
SharePoint
OneDrive
Teams
Trusted application → authorised access → compromised identity → potential exposure. The application identity needs the same attention as a human sign-in.
Answering the immediate question
Does this mean Microsoft 365 data has been stolen?
Not necessarily. Unauthorised access does not, by itself, establish that data was exfiltrated. Potential exposure depends on whether the affected application had been consented in a tenant and on the permissions previously granted. It does not mean every ConnectWise Cloud Backup or former SkyKick customer was affected.
Each organisation needs to establish whether its own tenant was affected and what activity occurred. Likewise, a review that finds no suspicious activity cannot conclusively exclude activity that was not captured in the tenant's retained logs.
At the time of writing, ConnectWise states that existing backup archives remain encrypted, isolated and preserved, with no evidence that the archives were accessed. It also said scheduled backups, archive access and restores were unavailable while remediation continued. The vendor's position on stored backup archives should be kept separate from the review of possible activity in an individual live Microsoft 365 tenant.
At the time of writing, ConnectWise asked partners to preserve available sign-in and audit records and to keep affected applications disabled pending restoration instructions. Disabling an application does not reverse any separate access already created. Follow the current vendor advisory, as investigation, remediation and validation remain ongoing.
“Compromise, access and data theft are not the same thing. The investigation needs to establish exactly what activity occurred within each affected environment.”
Turning a signal into owned work
Why continuous security monitoring matters.
On Friday, Wavex's SOC received a relevant security signal in monitored environments and initiated its incident-management process. A signal alone does not establish data access or exfiltration. That requires tenant-specific investigation.
Detection is only the beginning. The response model is Detection → Investigation → Security incident → Containment → Remediation → Validation. This is how a signal becomes owned work with a clear priority, evidence and next action.
“The value of a SOC is not simply that an alert exists. It is that somebody is watching, understands what the alert means and can initiate action.”
The wider lesson
Applications have identities too.
Most organisations rightly focus on employee passwords, MFA, Conditional Access, laptops and email. Microsoft 365 is also accessed by backup platforms, CRM applications, security products, AI services, workflow tools, reporting systems and automation. They may authenticate through certificates, secrets, tokens or service principals, and some may hold substantial privileges.
People
Employee passwords, MFA and sign-ins
Devices
Endpoints, browsers and mobile access
Applications
Certificates, secrets, tokens and service principals
Response
Monitoring, investigation and containment
“The modern identity perimeter includes machines and applications as well as people.”
Practical recommendations
Eight questions to ask your MSP following the SkyKick incident.
Receiving a security advisory is not the same as having the capability to respond to it. These questions help separate reassurance from evidence.
Have you checked our tenant, not just read the vendor advisory?
A generic supplier statement is not a substitute for checking the client environment and retained records.
Which third-party applications can access our Microsoft 365 tenant?
There should be a current, intelligible view of important enterprise applications and their owners.
What permissions does each application hold?
Broad or administrative application permissions deserve particular attention and regular review.
Do you monitor application identities as well as employee identities?
Modern security monitoring should consider application behaviour, not only user sign-ins.
Would you see an unexpected credential, certificate or privilege change?
Unexpected secrets, certificates, consent grants or role changes can be meaningful indicators.
What happens when the SOC sees suspicious application behaviour?
Look for investigation, containment and remediation, not simply an alert email.
Who responds if this happens at 2am on Sunday?
Supplier incidents and attackers do not operate to business hours, so the response model must not either.
All SaaS involves trust
Know → Limit → Monitor → Detect → Respond
This is not an argument against SaaS backup. Modern SaaS is useful. It does mean that connecting a service requires trust in the supplier, its credentials, employees, software supply chain and operational controls. No organisation can remove all supplier risk. The practical question is how quickly suspicious behaviour can be recognised, investigated and contained.
Know
Maintain an owned record of connected applications, why they exist and who is accountable for them.
Limit
Grant the smallest useful permissions and review broad access, credentials and app-only privileges.
Monitor
Watch human and application identity behaviour alongside endpoint, email and cloud signals.
Detect
Bring unexpected sign-ins, credentials, consent or privilege changes into a meaningful investigation.
Respond
Use a practical, owned containment and recovery process that can operate when it is needed.
Human-led, AI-assisted operationsRead: Cybersecurity Is No Longer About Buying Tools
Bring the relevant evidence together faster.
Security platforms generate very large volumes of sign-ins, alerts, identity changes, vulnerabilities, endpoint events, application events and historical incidents. Wavex engineers use AI to help aggregate relevant information and surface related evidence more quickly.
AI may help identify related security events, previous incidents, identity activity, application changes, vulnerabilities and affected services. It does not replace the security analyst or autonomously remediate critical incidents. It helps a person reach the important evidence faster.
Security monitoring connected to response.
Wavex combines 24x7 SOC monitoring, Microsoft 365 expertise, identity monitoring, endpoint security, vulnerability management, SaaS visibility, integrated incident management, AI-assisted analysis, experienced security engineers and ongoing risk review.
Significant activity does not operate in isolation. It becomes owned, prioritised, investigated, contained, remediated and validated through the wider incident-management process.
Proactive security cannot guarantee that a trusted supplier will never be compromised. It can help an organisation recognise unusual activity and respond more quickly.
Related Wavex content
Strengthen the controls around your connected services.
Cybersecurity and risk
Move beyond tool ownership to a risk-led security operating model.
Read the cybersecurity guideWhat good managed IT looks like
Understand the practical standards for proactive, accountable IT operations.
Read the managed IT guideProtecting information for AI
See how data loss prevention and information governance support safer modern services.
Read the DLP guideSet the AI boundary
Create a useful policy for approved tools, information and accountable use.
Read the AI risk policy guideManage supplier dependency
Explore resilience and control when an important technology provider becomes unavailable.
Read the supplier resilience guideExplore Wavex Cybersecurity
See how Wavex connects monitoring, identity, vulnerability and incident management.
Explore Cybersecurity & ComplianceTalk to Wavex about security
Is your Microsoft 365 environment being watched 24x7?
Wavex combines 24x7 security monitoring, Microsoft 365 expertise and integrated incident management to help identify and respond to suspicious activity across users, devices and applications.
If a trusted application connected to your Microsoft 365 environment were compromised tonight, would your IT provider know before you arrived at work tomorrow?