Weekly Briefing • October 23, 2026

On October 15, someone holding a stolen credential for a Microsoft 365 backup app used it to sign in to at least 173 organizations' Microsoft 365 environments without typing a single password. Cisco Talos documented scammers getting Staples' and Dell's own order systems to deliver their phishing emails for them. And a Montana pharmacy disclosed that a website a third party built for it exposed prescription and insurance records for 258,920 customers.

Last week's briefing was about trust: the way in is usually something you already trusted. This week sharpens that. In all three stories, the check the victim relied on gave the right answer to the wrong question. Multi-factor authentication protects people signing in, and no person signed in. An app did. Email authentication confirmed the order confirmations came from Staples and Dell, and they did. The pharmacy's investigators confirmed its internal systems were untouched, and they were. The records were on the website. Here's what happened, and what it means for how your firm operates.

The Backup App Could Read the Mailboxes. So Could Whoever Stole Its Key.

On October 15, a stolen credential belonging to ConnectWise Cloud Backup, the Microsoft 365 backup service formerly sold as SkyKick, was used to sign in to at least 173 Microsoft 365 tenants, the organization-level accounts that hold a firm's email, files and Teams, according to Huntress. Every sign-in came from one internet address, working through the tenants a few seconds apart, which Huntress reads as a script running down a target list. By October 17 Huntress was seeing sign-in activity from the same address in almost 1,000 tenants, more than 300 of them successful, though not every successful sign-in gained access. Microsoft assesses that a China state-aligned group it tracks as Storm-0940 was responsible. ConnectWise suspended the service on October 17 and began restoring it in phases on October 21, a process it expects to take several days.

Nobody's password was involved. A backup app like this one is connected to an organization's Microsoft 365 by consent, granted by an IT provider or an in-house IT person when the service is set up, and that consent lets it reach mailboxes, OneDrive, SharePoint and Teams so it can copy them. The credential the app uses to exercise that access lived in ConnectWise's own systems. Whoever held it had the app's access in every tenant where the app was connected: no password, no MFA prompt, and nothing on the sign-in screen most people check, because app sign-ins are recorded on a separate tab. The same address had spent October 13 and 14 trying passwords against four law firms' Microsoft 365 accounts, with no successful sign-ins in Huntress's data. The front door held. The app's door was already open. In two tenants Huntress examined, a ConnectWise app then made itself a Global Administrator and planted new credentials on other apps, which is a way back in that does not depend on the stolen one. Huntress found no sign of mailboxes, files, users or policies being changed in either.

For a medical, legal or accounting practice, the mailbox is where patient records, client files and invoice threads live, and Todyl's analysis says this app's access included reading and writing mail and attachments. Write access means a fake payment request can be placed inside a thread your billing staff already trusts. The harder problem is proof. Reads of the company directory through Microsoft Graph leave no entry in the standard audit log. Where reads of mail and files are logged, the records name the backup app, so Todyl could not tell the attacker's reads from the backup service's own. A firm may never be able to show what was or wasn't read. Under HIPAA, the notification clock starts when a breach is known, or would have been known with reasonable diligence, not when you can prove what was taken.

If someone outside your office manages your Microsoft 365, your exposure is set by the list of apps that provider has connected to your tenant and what each one is allowed to do, and most firms have never seen that list. Ask whoever manages your Microsoft 365 for it, along with who approved each app. If ConnectWise Cloud Backup is on it, even unused, you are in the group ConnectWise says should review its records, and Microsoft and Huntress both say to disable, not delete, any app nobody can account for. Full analysis here: Compromised ConnectWise Credential Used to Sign In to 173 Microsoft 365 Tenants.

The Order Confirmation Really Came From Staples. The Phone Number in It Didn't.

Cisco Talos has documented scammers getting real companies' systems to send their phishing for them. In two campaigns, about 1,400 messages in all, the emails came from Staples' and Dell's own order systems: a Staples confirmation for an Apple iPad, and a Dell order for Microsoft Project Standard 2024 at $736.09. The scammers had typed their own text into fields the retailers' systems later printed into the email, so where the shipping and billing details should have been, the message said "Order Confirmed" and gave a "Helpline" number. There was no forged sender, no link and no attachment. SPF, DKIM and DMARC, the checks that confirm an email really came from the domain it names, all passed, because it really did. Talos counted abuse of more than 25 legitimate platforms over the past year, across collaboration, file-sharing, survey, payment and AI services.

The attack is the phone call. Someone at your front desk sees an order for an iPad nobody ordered and calls to cancel it, and the person who answers walks them into a payment, a password, or remote-access software that hands over a live session on a work computer. The call happens off your network, so there is no click, download or log entry for anything to catch, and the first anyone hears of it may be days later, when the employee mentions it. If someone on your staff has called a number from an email like this, treat it as an incident and pin down when the call happened, what the caller was given, and whether anything was installed. Those are the questions your cyber insurer will ask, and if nobody can fix a start date, counsel will generally advise notifying on the widest scope you can defend. Full analysis here: Attackers Parasitize Trusted Infrastructure to Deliver Malicious Payloads.

The Pharmacy's Systems Were Untouched. The Website Someone Else Built Held 258,920 Customers' Records.

Ridgeway Pharmacy, a mail order and community pharmacy in Victor, Montana, has disclosed that its public website exposed names, addresses, dates of birth, prescription, health and insurance information for 258,920 customers, and payment card information for some of them, as reported by The HIPAA Journal. A third party designed and built the website, and investigators confirmed the incident was limited to it and that no internal systems were involved. The pharmacy learned of the exposure on August 21, has since moved to a new website platform, and offered affected customers credit monitoring. The same reporting covered two smaller cases: IMS Care Center, a Phoenix practice where someone was inside the email system on June 17 and 18 and was shut out on the second day, and a Minnesota dental practice where an intrusion from April 28 to April 30 exposed diagnosis, treatment, insurance and Social Security information for 3,386 patients.

This is the third briefing this month to land on the outside businesses that hold your records. On October 2 the point was that breach notification follows the data, not the server, and Ridgeway is that point again at a larger scale. What this week adds is time. IMS Care Center caught its intruder within a day, and its review still did not confirm that Social Security numbers and medical information were exposed until September 30. The letters went out October 16. The Minnesota practice's file review finished months after the intrusion. Fast detection shortened the attacker's window. It did not shorten the review, because the review is someone working out what was in the system, whose it was, and when that can be put in writing, and the notification deadlines, the state attorney general reports and the report to HHS's Office for Civil Rights all run off that answer.

The way to shorten it is to have the list before anything happens. For a medical or dental practice, that means every outside party that touches patient data: your website developer, any chat or analytics tool on your website, your reminder service, your claims clearinghouse and your IT provider. For each one, confirm you hold a current business associate agreement and know which records it can reach. Then stop keeping records you no longer need, because those are records you cannot lose. Full analysis here: Ridgeway Pharmacy Data Breach Affects 259,000 Individuals.

Also on Our Radar This Week

9 Rising Malware Trends Security Pros Should Know From ClickFix to Akira — Immersive puts infostealers such as Lumma Stealer, StealC and RisePro behind 75% of stolen credentials, and what they take is more than passwords: browser cookies, VPN logins and MFA tokens, packaged and sold on dark web markets to whoever is buying. The person who infects a laptop is often not the one who uses the login. Ransomware crews like Akira buy that access, take the data first and encrypt last. So an infostealer found on any computer means every account and signed-in session on that machine is compromised, not just the passwords saved on it.

Kiloview E3 NDI Encoder Affected by Nine CVEs Including CVE-2026-105265 — CISA published nine flaws on October 22 in a small hardware encoder that turns a camera feed into a network video stream, two of them rated 9.9 out of 10. Every unit signs its logins with the same built-in secret, so anyone with the public firmware can forge an administrator session. Kiloview's firmware 1.30 fixes all nine, and CISA reports no known exploitation. If your office streams or records meetings through dedicated video hardware, that box is a Linux computer, usually installed by an AV integrator, and nobody in IT may hold its password or update it. Find out who does.

Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.

Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.