A Backup Vendor's Stolen Key Opened 160 Companies' Email

The morning someone else read the mail

Early on the morning of October 15, a single automated script signed into the Microsoft 365 accounts of more than 160 businesses. It did not guess a password. It did not trick an employee with a phishing email. Nobody’s phone buzzed with a login prompt.

The script walked in through a backup tool. One that most of the affected business owners probably never knew was installed.

Security researchers at Huntress confirmed the break-ins from Microsoft’s own sign-in records. The tool is ConnectWise Cloud Backup, formerly known as SkyKick, a product IT providers buy to back up their clients’ Microsoft 365 email and files. ConnectWise is one of the biggest software vendors in the IT services industry, and it happens to be headquartered in downtown Tampa. If a Florida IT company manages your technology, there is a real chance ConnectWise software touches your business somewhere.

How a backup app becomes a master key

When an IT provider sets up a backup service for Microsoft 365, the backup software gets its own credential. Think of it as a key the software uses to let itself in and copy your mail and files every night. That key does not belong to you, and it does not live in your office. It lives with the vendor.

SpecterOps, a security firm that analyzed the incident, put it plainly: the credential belongs to the application itself, so whoever holds it inherits everything the application is allowed to do. No user, no device, and no MFA prompt is involved. Every security setting your provider carefully configured on your staff accounts never enters the picture.

Somebody got hold of that key. Huntress confirmed unauthorized sign-ins across 162 customer environments, and press reports counting a wider net put the number at 173. The application’s permissions reached into email, OneDrive files, SharePoint, and Teams chats. How the credential was stolen has not been disclosed.

The sign-ins came from a single hosting-provider address between 6:13 and 8:34 that morning, moving from one victim organization to the next a few seconds apart, in neatly sorted order. That is a script working through a list. Not a person poking around.

The detail that should worry you more than the break-in

In at least one affected organization, the attacker used a related ConnectWise application to promote itself to Global Administrator, the highest level of control that exists in a Microsoft 365 account. It then quietly planted new credentials of its own inside two other trusted applications, set to expire in 2028.

Read that again. Even after the stolen key gets changed, the intruder may have left spare keys that keep working for two more years, hidden inside software the business already trusts.

ConnectWise shut off the affected applications while it investigates and says it has found no evidence that customer backup data was compromised. Huntress has told affected customers to disable the app, review their account activity records for October 14 through 16, and keep it off until ConnectWise confirms the stolen credential has been replaced.

Five questions to ask your IT provider this week

You do not need to understand the plumbing to hold your provider accountable. Ask these, in writing:

1. Which outside applications have standing access to our Microsoft 365, and why?
2. Were we using ConnectWise Cloud Backup, and if so, when was it disabled?
3. Did anyone review our sign-in and activity logs for October 14 through 16?
4. Who reviews vendor app permissions in our account, and how often?
5. If this had hit us, when would we have heard from you?

That last one matters most. A week like this is when you find out whether you hired a partner or a reseller.

If the answers are slow, vague, or defensive, take that seriously. Plenty of Florida businesses only discover what their IT contract actually covers during an incident. If you are already wondering, our guide to switching IT providers walks through what a clean transition looks like, including how to move without onboarding fees and what to do when the old provider drags its feet.

And switching is not the only option. Some owners like their current IT people and simply want independent review. A co-managed IT arrangement keeps your existing staff or provider in place and adds a second set of eyes beside them, which is exactly what this incident rewarded.

Somebody has to actually read the logs

Here is the uncomfortable part. The records that exposed this attack are sign-in logs for applications rather than people, and most small businesses have never opened them once. The data was sitting there. Someone had to look.

Huntress caught this because watching those records is their job. That is the entire case for managed security services in one sentence: tools generate evidence all day, and it protects nobody until a human reads it. Cyber Command runs a human-managed security operations center designed to flag exactly this pattern, a trusted application signing in from somewhere it never has before. We also keep a standing inventory of which vendor applications can reach client data, reviewed on a schedule instead of after a headline.

No one can honestly promise that a vendor’s key will never be stolen. This week proved that. The honest goal is to notice fast, cut off access, and have backups and a plan ready, so a bad morning does not become a bad quarter.

If you run a business in Orlando, Tampa Bay, or Jacksonville and you cannot name the applications holding keys to your Microsoft 365, that is a solvable problem. Talk to a real engineer at (407) 587-0089. No phone tree, no ticket black hole. Just an answer.

#CyberSecurity #ManagedIT #Microsoft365 #SmallBusiness #TampaBay