ConnectWise Cloud Backup Credential Compromise Exposes 173 Microsoft 365 Tenants to Supply Chain Attack

On October 15, 2026, threat actors successfully weaponized a compromised Microsoft 365 API credential belonging to ConnectWise's Cloud Backup application (formerly SkyKick Backup). This allowed them to authenticate across 173 downstream Microsoft 365 tenants without requiring passwords or multi-factor authentication (MFA) from individual users. The authentication occurred as the application itself, effectively bypassing user-centric security measures. ConnectWise subsequently disabled access to its Cloud Backup service on October 17, 2026, and is investigating the incident. This incident is highly significant for DevSecOps practitioners because it exposes a fundamental weakness in the modern software supply chain: the inherent trust placed in third-party applications. When a vendor's application identity is compromised, the blast radius extends to every customer tenant where that application has been granted permissions. This negates the effectiveness of many customer-side security controls, as the malicious activity originates from a trusted application rather than a rogue user. The incident affects any organization utilizing ConnectWise Cloud Backup, and more broadly, any organization relying on third-party cloud applications with extensive permissions. This event fits into a broader, well-established trend of supply chain attacks and the increasing focus on securing application identities. The industry has seen a rise in attacks targeting the software supply chain, where vulnerabilities in one component can compromise an entire ecosystem. The shift towards cloud-native architectures and the proliferation of SaaS applications mean that organizations are increasingly reliant on external vendors, expanding their attack surface. The concept of "trust-through-defaults" is proving to be a critical vulnerability, as applications often come with broad default permissions that are rarely reviewed or restricted. In practice, this means practitioners must adopt a more proactive and skeptical approach to third-party integrations. Key actions include: rigorously auditing the permissions granted to all third-party applications, especially those with access to critical systems like Microsoft 365; implementing continuous monitoring for anomalous application activity, not just user activity; and pushing vendors for greater transparency and stronger security controls around their application identities. Organizations should also consider implementing a "zero-trust" approach to application access, ensuring that even trusted applications are only granted the minimum necessary privileges and that their activity is continuously validated. This incident serves as a critical reminder that supply chain security is not just about code, but also about the identities and permissions of every component in the ecosystem.