ConnectWise has shut down customer access to its Cloud Backup service, previously known as SkyKick Cloud Backup, after a supply-chain attack led to compromised application identities and affected Microsoft 365 tenants. While technical details may still be emerging, the reported incident is notable because it appears to involve trusted third-party access into Microsoft 365 environments rather than a simple end-user phishing case.

What happened

According to the reported incident, attackers gained access through ConnectWise's Cloud Backup environment and used compromised application identities to reach customer Microsoft 365 tenants. ConnectWise responded by restricting customer access to the service.

The case is being described as a supply-chain attack because the compromise appears to have affected downstream customers through a service provider or integrated platform. In practice, this means businesses may face exposure not only from attacks on their own staff or systems, but also from software vendors and service providers that hold privileged access to cloud environments.

Why it matters for European businesses

Many European SMEs rely on Microsoft 365 for email, documents, collaboration, identity-linked workflows, and backup. They also often depend on managed service providers, SaaS integrations, and backup platforms to administer or protect those environments. When one of those third parties is compromised, attackers may be able to abuse existing permissions without directly breaking into the customer network first.

This has several business implications:

• Third-party access can become a direct security risk. Applications connected to Microsoft 365 may hold broad permissions across mailboxes, files, backups, or tenant administration.
• Backups and business continuity may be disrupted. If access to a backup platform is suspended during an incident, companies may face short-term operational uncertainty around recovery and retention processes.
• Identity security is central. Application identities, service principals, and consented permissions are often less visible to non-technical teams than user accounts, but they can provide powerful access paths.
• Regulated businesses may face additional response obligations. Depending on what data was accessible and the role of the affected service, organisations may need to assess contractual, security, and privacy consequences under existing obligations.

For companies in the EU, this is also a reminder that supplier security is not just an IT issue. It can affect operational resilience, data protection, and customer trust, especially where business-critical Microsoft 365 data is involved.

Who may be affected

The most directly affected organisations are likely to be businesses using ConnectWise Cloud Backup or its earlier SkyKick-branded service in connection with Microsoft 365. Companies working with MSPs, IT providers, or resellers that manage backup and tenant integrations on their behalf may also need to check whether their environment depends on the affected service.

Risk may be especially relevant for:

• SMEs that outsource Microsoft 365 administration or backup management
• E-commerce and service businesses that rely heavily on Microsoft 365 email and document workflows
• IT teams responsible for Entra ID, Microsoft 365 app permissions, and SaaS integrations
• Regulated organisations that must assess vendor incidents carefully for security and data governance reasons

What companies should consider

Businesses that use the affected service, or similar third-party Microsoft 365 integrations, should consider a structured review with internal IT teams or service providers.

• Confirm exposure. Determine whether your organisation uses ConnectWise Cloud Backup, SkyKick Cloud Backup, or related managed services through a partner.
• Review application permissions. Check enterprise applications, consented permissions, and service principals connected to Microsoft 365 and Entra ID. Look for unusually broad or no-longer-needed access.
• Assess tenant activity. Review Microsoft 365 and identity logs for unusual access, mailbox activity, privilege changes, or suspicious application behaviour.
• Verify backup continuity. Confirm what data remains protected, whether restore processes are affected, and what temporary business continuity measures are needed while access is restricted.
• Engage suppliers. Ask service providers what systems were affected, what indicators of compromise are available, and what customer-side actions they recommend.
• Revisit third-party risk controls. This includes limiting app permissions, using least-privilege access, documenting critical SaaS dependencies, and ensuring incident response plans include supplier compromise scenarios.
• Assess data protection implications. If personal data may have been exposed, organisations should evaluate whether further internal review or legal assessment is required under existing rules.

At this stage, companies should distinguish between the confirmed shutdown of access and any broader assumptions about the scale of customer impact. However, the incident underlines a clear lesson for European businesses: Microsoft 365 security depends not only on user accounts and endpoint protection, but also on the security of connected vendors, backup tools, and cloud application identities.