ConnectWise, an IT management software provider, has suspended three cloud services after attackers used compromised application credentials to access customers’ Microsoft 365 environments.

 

What happened

ConnectWise suspended Cloud Backup, formerly SkyKick, following a security incident involving unauthorized access to customers’ Microsoft 365 environments. Cybersecurity Dive reported that SaaS Security and Cloud Management were also suspended because they are connected to the backup service.

According to the report, Microsoft confirmed that it was tracking an attack involving a trusted ConnectWise application. Microsoft assessed that the attacker likely abused permissions customers had previously granted to the application.

ConnectWise first disclosed the incident on October 16, 2026, and disabled seven application identities on October 17. As of its October 20 update, scheduled backups and restores remained unavailable. The company reported no indication that stored backup archives had been compromised, while noting that this did not establish whether customers’ live Microsoft 365 environments were affected.

 

What was said

In its incident FAQ, ConnectWise stated, “Whether a product vulnerability contributed has not been established, and the original credential-exposure mechanism remains under investigation.” The company has therefore not established how the attackers originally obtained the compromised credentials.

 

Why it matters

For healthcare organizations using affected integrations, the concern is whether trusted software could have provided unauthorized access to patient correspondence and attachments. Todyl’s investigation found that the application’s existing permissions gave attackers the technical ability to access mail and files in the environments it examined.

A 2026 Journal of Multidisciplinary Healthcare study analyzed 7,327 healthcare breach reports from 2010 through 2025. The researchers found that “business associate involvement was independently associated with a larger breach magnitude.” The finding supports closer oversight of vendors that handle patient information.

Separately, Paubox’s 2026 Healthcare Email Security Report found that 53% of the breached organizations it analyzed used Microsoft 365 as their primary email platform. Its analysis covered email-related healthcare breaches reported to HHS in 2025 and provides background on healthcare email security.

The ConnectWise and Huntress disclosures reviewed do not confirm healthcare victims or theft of protected health information (PHI).

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Could organizations that stopped using SkyKick still be affected?

Yes, if an application connection remained active. Ending a subscription does not necessarily remove previously granted application access.

 

Would employee multifactor authentication have prevented these sign-ins?

Employee multifactor authentication did not apply to the application-based sign-ins described by Todyl. The attacker authenticated as software using its credentials, without an employee logging in or approving a prompt.

 

Does a vendor security incident automatically require patient notification?

No, HIPAA notification depends on whether a breach of unsecured PHI occurred. An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the information was compromised. Organizations must document the basis for their notification decision.