In the early hours of October 15, something signed in to at least 173 Microsoft 365 tenants in about two and a half hours. It never typed a password or answered a multi-factor prompt. It held the credential for ConnectWise Cloud Backup, formerly sold as SkyKick, a backup app IT providers install into their clients' Microsoft 365 to copy mail and files around the clock. Whoever holds that credential inherits the app's access in every tenant where it is installed. Huntress, a security company that confirmed the sign-ins, saw them come from one internet address, a few seconds apart in order of tenant ID, the pattern of a script working down a list. Huntress's count grew in a later update: almost 1,000 tenants with sign-in activity from that address, more than 300 of them successful. Huntress says that while many of those sign-ins succeeded, in some tenants the app was not present, which kept the attacker from getting in.
On October 21, Microsoft said it assesses that Storm-0940 was responsible. Microsoft describes Storm-0940 as a China state-aligned group active since 2021, and says the group used ARTEX, an AI framework built for penetration testing (simulated attacks), to try to sign in to more than 2,250 tenants. ConnectWise now says it appears a China state-aligned group was behind the attack, based on evidence that includes Microsoft's threat intelligence. ConnectWise says how its credentials were first exposed is still under investigation.
Whoever was behind it, the useful question for a firm whose Microsoft 365 is run by an IT provider is what kind of access made this possible, because managed tenants commonly carry the same kind for backup, security and management tools.
Why multi-factor never came up
Most of the security a small firm pays for watches people signing in: multi-factor authentication, password rules, conditional access, sign-in alerts. A backup app is a different kind of identity. An administrator approved it once, and that approval gave it standing permissions. From then on it signs itself in, machine to machine, and those sign-ins land on a separate tab, service principal sign-ins, that the default view in the Microsoft Entra admin center does not show.
So the usual reflexes do not reach it. A password reset means nothing to an app that never used one, and revoking user sessions means nothing when no user session exists. Even disabling the app leaves the tokens it already holds working for up to 90 minutes. The same address had tried password spraying against four law firm tenants on October 13 and 14, with no successful sign-ins that Huntress could see. The next day, holding the app's credential, it signed in to at least 173 tenants.
What that access reached
A backup app needs broad consent because its job is to copy everything. Todyl's analysis says the token carried read and write access to mail and attachments, OneDrive and SharePoint files, and Teams chats, plus the ability to restore data into the tenant. Microsoft says the abused permissions likely included Directory.ReadWrite.All, which lets the holder change users and groups. In multiple tenants, Microsoft says, the attacker went further: reconnaissance, changes to application credentials, and attempts to change privileges. Microsoft warns that credential changes like these can stay in place as a way back in even after the original app is shut off.
Huntress found the same procedure in both tenants it reviewed: a ConnectWise app made itself a Global Administrator, then added new secrets, which work like passwords for apps, to a small number of other apps. In the first tenant, the app was ConnectWise's cloud management app for Microsoft Teams. The secrets went to an IT management tool, the kind providers often connect to their clients' tenants, and to Huntress's own security app. Huntress says it has not seen access spread to a provider's clients that way, though it did see sign-in attempts from the second tenant into other tenants it protects.
For a medical or dental practice, a law office or an accounting firm, the backup app's access can cover much of what the practice keeps in Microsoft 365: patient and client correspondence, shared files, tax records, payroll, and the chat threads staff assume nobody reads. Write access matters as much as read access. Someone who can drop a message into a thread your bookkeeper already trusts is one step from a fraudulent change of bank details.
The harder problem for a regulated firm is proof. Reads of directory data through Microsoft Graph, such as user and group details, leave no entry in the standard audit trail, so a quiet directory log does not show that nothing was read. Microsoft notes that a successful sign-in does not necessarily mean data was accessed or taken. Even so, Huntress suggests acting now instead of waiting for proof of access, and Todyl recommends that every affected organization treat its data as exposed.
Notification duties typically stay with you even when the breach started at a vendor. Under HIPAA, an IT provider that can access patient information is commonly a business associate, and the business associate agreement is where breach notification between you belongs. The FTC's Safeguards Rule, which reaches tax preparers and many accounting firms, expects you to oversee service providers through contract terms and periodic review. Since May 2024 the rule can also require you to notify the FTC within 30 days of discovering that unencrypted customer information about 500 or more consumers was accessed without authorization, unless you have reliable evidence it was not acquired. Ohio's breach-notice law can separately require notice to affected Ohio residents as soon as possible, and no later than 45 days after you discover or learn of the breach. It applies when a name, together with an unencrypted Social Security number, driver's license or state ID number, or a financial account or card number and the code needed to use it, is reasonably believed to have been accessed and acquired in a way that creates a material risk of identity theft or other fraud. The Ohio law does not apply to HIPAA covered entities or to certain regulated financial institutions. Whether any of these notice rules applies to your firm after this incident is a question for your lawyer.
Lawyers' conduct rules, in Ohio and most states, are commonly read to require reasonable supervision of vendors who handle client information. And Ohio's Data Protection Act may offer an affirmative defense in some breach lawsuits. The defense covers only tort claims under Ohio law or in Ohio courts, such as negligence, that blame a breach on a failure to use reasonable security controls, and only for a business that maintains and follows a written cybersecurity program that reasonably conforms to a recognized framework. Those frameworks typically cover vendor risk.
When ConnectWise suspended the service on October 17, scheduled backups stopped for firms using the app, and so did restores. On October 21, ConnectWise said it had begun bringing the service back in phases and expects that to take several days. It cautions that this does not mean every feature is available yet. It says existing backup archives remain encrypted, isolated and preserved, with no indication they were compromised. ConnectWise and Huntress both suggest checking for a gap in recovery points, the points in time you can restore from. Ask your provider when the last good backup ran and how the gap is being covered.
Five questions for whoever manages your tenant
Capstone is a managed provider too, so treat these as questions any client should be able to put to any provider, us included. A good answer is a document, not a reassurance.
- Which third-party apps have standing consent in our Microsoft 365, what can each one read or change, and who approved it? Get the list in writing, and require an administrator's sign-off for new consents.
- Which of your staff and tools hold administrative access to our tenant? Delegated admin relationships and app credentials should each be cut to the narrowest role that still works.
- Are service principal sign-ins, the Microsoft 365 audit log and Microsoft Graph activity logs captured and kept long enough to investigate? Auditing is off by default in Microsoft 365 Business plans. Graph activity logs need an Entra ID P1 or P2 license and record nothing from before they are turned on, and without them an attacker's reads through an app can look the same as the app's own. Todyl found that Microsoft 365 audit log records of mail and file reads name the app but show Microsoft's own IP addresses, not the attacker's. On the free tier of Entra ID, Entra's own sign-in and audit logs are kept for only seven days unless someone exports them.
- Who would notice? An app signing in from somewhere it never does, a new secret added to an app, or an app granting itself an admin role should alert someone, the same as a suspicious user sign-in.
- What does our contract say when the breach starts at one of your vendors? Look for who notifies your clients or patients, who pays for forensics, whether a business associate agreement is signed where HIPAA applies, whether your provider holds one with each of its own vendors that store, receive or transmit your patient data, such as a backup service, and whether you can see which apps are consented into your tenant. Many IT agreements were written around uptime and say little about this.
Our Threat Intelligence Center write-up has the technical breakdown, including the logs and filters an IT team should check: audit records back to at least October 13, and sign-in records back to October 1 where they still exist. If these questions do not get straight answers, put them to your provider in writing. Our security assessment is a 15-minute call, then written findings on five areas: dark web exposure, phishing risk, security controls, remote access and employee training readiness.
Updated October 22, 2026: This post first said no one had publicly named who was behind the attack, but Microsoft had done so on October 21. We added its attribution, Huntress's later counts and ConnectWise's October 21 restoration update, and changed the headline. We also corrected when the sign-ins started and how long they took, who gave the app its permissions, how much of a practice's data the access could reach, what Huntress found, which advice came from Huntress and which from Todyl, what Microsoft 365's logs record, when Ohio's Data Protection Act offers a defense and what a security assessment covers. The post first said firms had lost their backups. ConnectWise says existing backup archives are preserved. We added the FTC and Ohio notice deadlines, a question about your provider's agreements with its own vendors, and the October 1 look-back for sign-in records.
