Security researchers have warned of an active campaign in which attackers are reportedly using a compromised Microsoft 365 credential associated with ConnectWise Cloud Backup, formerly SkyKick, to gain unauthorised access to customer Microsoft 365 environments. According to the report, 173 Microsoft 365 tenants were affected.

The development matters beyond one vendor because many European businesses rely on managed service providers, backup platforms and third-party SaaS tools that hold privileged access to Microsoft 365. When one trusted integration is compromised, the impact can extend across multiple customer environments.

What happened

According to cybersecurity reporting cited in the source, unknown threat actors abused a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup. The product is used by managed service providers to deliver cloud backup and recovery services for customer environments.

Based on the reported findings, the attackers used that credential to sign in to customer Microsoft 365 tenants. At the time reflected in the source, researchers described the activity as an active campaign. The source does not establish all downstream impacts for every affected tenant, so businesses should distinguish between unauthorised access and any confirmed follow-on actions such as data theft, mailbox access or persistence.

Why it matters for European businesses

For many SMEs, Microsoft 365 is core business infrastructure covering email, files, identity and collaboration. A compromise affecting a backup provider or MSP-facing tool can therefore create operational, security and compliance risks across multiple organisations at once.

This incident is also a reminder of a broader supply-chain security issue: businesses may secure their own accounts well, but still be exposed through third-party service providers with delegated or privileged access. That is especially important for companies that outsource Microsoft 365 administration, backup, migration or security operations to MSPs.

For European organisations, the consequences may include:

• Business disruption if attackers access email, files or tenant administration functions.
• Data protection risk where personal data stored in Microsoft 365 may have been exposed.
• Third-party risk management issues if suppliers hold broad permissions that are not regularly reviewed.
• Incident response complexity because remediation may require coordination between the customer, the MSP, Microsoft 365 administrators and the SaaS provider.

For regulated sectors or companies with contractual security obligations, the incident may also trigger vendor review, logging checks and internal reporting processes. Exact legal obligations depend on the facts of each case and applicable national and EU rules.

Who may be affected

The most directly affected organisations are those using ConnectWise Cloud Backup, formerly SkyKick, especially where the service is deployed through a managed service provider. However, the wider lesson applies to any company using third-party tools with access to Microsoft 365.

• SMEs using MSPs for Microsoft 365 administration, backup or recovery.
• IT teams responsible for Microsoft 365 identity, audit logs and SaaS integrations.
• Regulated businesses that must document supplier access and incident handling.
• Digital-first companies whose email and document workflows depend heavily on Microsoft 365 availability and integrity.

What companies should consider

Businesses that use ConnectWise Cloud Backup or similar Microsoft 365-connected services should review the issue with their provider and assess whether their tenant was exposed.

• Identify affected integrations: confirm whether your organisation uses ConnectWise Cloud Backup, SkyKick or comparable tools with Microsoft 365 access.
• Review sign-in and audit logs: look for suspicious sign-ins, unusual consent activity, unexpected administrative actions and abnormal mailbox or file access.
• Check delegated permissions: inventory third-party applications, service accounts and partner relationships with access to Microsoft 365.
• Reassess privileged access: reduce unnecessary permissions and apply least-privilege principles to vendor and MSP accounts.
• Coordinate with suppliers: ask your MSP or service provider what happened, what accounts or tokens were involved, and what remediation steps have been completed.
• Prepare incident response actions: if suspicious activity is found, preserve logs, isolate affected accounts and escalate through your internal security or external response process.
• Review data protection implications: where personal data may have been exposed, assess whether notification or additional documentation may be required under applicable rules.

Even if a company is not directly affected, the incident is a practical prompt to revisit SaaS supply-chain security around Microsoft 365. For many SMEs, the main risk is not only password theft from employees, but also over-trusted third-party access that remains invisible until a vendor credential is abused.