The company that keeps the backup copies for a business could read every email in it.
That was the setup long before anyone got hacked. Last week something finally used it.
Here is what happened, in plain terms. A wide range of IT providers connect a Microsoft 365 backup product to their clients' accounts. The product, ConnectWise Cloud Backup, is known to many by its earlier name, SkyKick, and its job is to copy your email, your files, and your team's messages somewhere safe so they can be restored after a disaster. To do that job, the software holds a key to your Microsoft 365 account. Not a password someone types. An application key, issued once, that lets the software walk in on its own schedule and read everything a backup needs to read: mail and attachments, files, and the full text of your team chats.
In mid-October, criminals got hold of the software's secret. By the weekend, the security firm Huntress had confirmed 162 companies where the stolen credential had signed in, and the count reached 173 within a day. The vendor, ConnectWise, cut off the service on October 17, disabled the software's identities, and shut the backup platform down entirely while it investigates. As of Monday the service was still down: no scheduled backups, no restore. The vendor says the backup archives themselves show no sign of tampering and that the stored data is intact. How the original key was stolen, nobody has said yet.
The part that should bother every owner
Passwords get stolen every week. What made this one matter was reach. The credential did not belong to a person, and it did not work at one company: it was the backup software's own key, and the same key works in every Microsoft 365 account where the product is connected.
Ask any owner how their company is protected and you will hear about the approval code. The extra step at sign-in, the one where your phone buzzes and you tap yes. It is real protection; most account-takeover attacks die at that step. It works because there is a human on one end of it. In this breach, there wasn't one. The stolen credential belonged to the software, and software does not get buzzed on the phone. The criminals did not need to trick anybody. They logged in as the backup product itself, exactly the way the real product does every night.
From there, the damage potential was the tool's own permissions: read and write access to mail, files, and chat across the whole company, in every customer where it was installed.
The attacker moved through the customer list the way software does: an automated script, one internet address, working down the tenants in sorted order. In the tenants examined by researchers so far, the activity centered on reading data. But in nearly 50 tenants the picture widened. Software from the same vendor family, installed alongside the backup, handed itself new administrative roles in the customer's own directory, mostly over email. In one tenant on the record, one of those tools promoted itself to the highest administrative seat in the company and planted two new credentials, set to expire in 2028. The operation took about five minutes. Microsoft's threat intelligence team assessed the whole event as an active supply-chain attack, meaning the entry point was software the customers had invited in.
Why this one is different from the usual vendor breach
Five months ago, this series covered a breach where criminals reached court records in eleven states through a software vendor. The lesson then was about distance: your data lives at your vendors, and their defenses become your defenses whether you chose them or not.
This breach has no distance in it. The software sits inside the customer's own Microsoft 365, holding standing permission to touch mail, files, and chat. Whoever connected the software approved that permission once, and after that the key worked quietly, with no reason for anyone inside the business to look at it again.
The criminals never touched the customers. And shutting the vendor's platform down does not end the story for everyone: Huntress's guidance tells administrators to review the credential lists inside every tenant, because keys planted inside a tenant keep working after the platform goes dark.
What a business owner can actually do
The checklist here belongs to your IT provider, and most of it is administrative review, not new equipment. But the owner does own the questions. Three of them, this week, in plain language:
Do we run this software, or anything that works this way? Any IT provider or management tool that your provider connected to your Microsoft 365 holds a key like this. You want the list: which products, what they can reach, and whether the vendor was touched by this event.
What else has standing access we never review? Every application in your Microsoft 365 that was given permanent permission is a door that works without a person. Ask for the list of connected software, sorted by what each one could read, and ask who is responsible for looking at it, and how long it has been since anybody did. If the answer is "nobody since we set it up," that is a finding, and it is fixable in an afternoon by a competent administrator. The industry guidance coming out of this event is concrete: sweep the credential and permission lists for anything added since October 13, and remove what no one can explain.
If a key like this were stolen today, how long until someone noticed? The vendors in this story found it because security firms watch for sign-ins that don't match history. Your provider should be able to tell you whether anything watches your tenant the same way.
The bottom line
The software that was supposed to protect this data became the way into it, through a credential whose permissions no customer had ever needed to revisit. The approval code on the phone never had its moment, because no person ever logged in.
If you don't know which software holds standing access to your email, files, and team chats, that is not an accusation. It is a question worth answering on purpose, this month, with your IT provider or with someone who does this for a living.
Story reporting: BleepingComputer, October 17 and 18, 2026, with findings attributed to security firm Huntress, Microsoft, and security platform Todyl, and an advisory from ConnectWise.