ConnectWise investigating potential Cloud Backup Breach
Description
ConnectWise is investigating unauthorized access attempts targeting its Cloud Backup platform, formerly known as SkyKick. The company has initiated incident response and containment measures but has not confirmed any successful data access. Third-party intelligence suggests possible compromise and lateral movement into live Office 365 environments of MSP customers. Indicators of suspicious activity include specific IP addresses and user agents. The investigation is ongoing, and no confirmed data breach has been reported yet.
Reddit Discussion
ConnectWise posted to their status page that they're investigating unauthorized access events in the Cloud Backup platform (which used to be SkyKick).
So far they have NOT confirmed that anyone successfully got in, but third-party intelligence sources are saying that not only did someone get in, but also that the threat actor pivoted to the live O365 environments of customers of MSP's using ConnectWise Cloud Backup.
For reference, Cloud Backup is used by MSP's to back up all of O365, including EntraID. So if someone did break in and access data files... this is gonna be bad.
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ConnectWise reported an ongoing investigation into suspicious authentication activity within its Cloud Backup environment. While no confirmed data access has been established, third-party sources allege that threat actors may have gained access and pivoted to customers' live Office 365 environments, potentially exposing backup data including EntraID. ConnectWise has deployed containment measures and shared indicators of compromise such as source IP 144.172.64.128 and user agents 'Python-urllib/3.12' and 'python-requests/2.31' to aid monitoring. The incident response is active, and further details are pending.
Potential Impact
If the unauthorized access is confirmed, it could lead to exposure of sensitive backup data for MSP customers, including Office 365 and EntraID information. This could compromise customer environments and data integrity. Currently, there is no confirmed evidence of data access or breach, but the potential impact is significant given the nature of the data involved.
Defensive Guidance
ConnectWise has implemented containment measures and is actively investigating the incident. At this time, no confirmed breach has been reported, and customers should monitor official ConnectWise status updates for further guidance. The provided indicators of compromise (IP address and user agents) can be used for internal monitoring. No specific patch or fix is available or indicated. Follow ConnectWise advisories for updates.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":40,"reasons":["external_link","newsworthy_keywords:breach","urgent_news_indicators","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":["breach"]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6ad2981a2cdf04f6563b108e
Added to database: 10/16/2026, 21:33:14 UTC
Last enriched: 10/16/2026, 21:33:17 UTC
Last updated: 10/17/2026, 01:48:16 UTC
Views: 26
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.