MFA never got a vote. A backup app's own secret opened Microsoft 365 tenants.
By Lior AharonovFounder, 7IT Solutions ·
BleepingComputer reported on 17 October 2026 that ConnectWise shut customer access to its Cloud Backup service, formerly SkyKick, with no timeline for restoring it. Attackers signed in as the app itself and could reach mail, OneDrive, SharePoint and Teams data that customers had granted it. Huntress confirmed at least 162 compromised tenants in its environment.
Your backup tool has standing permission to read your company mail and files. A scripted sign-in with the app identity asks no one for a code, so MFA never comes into play.
If you use ConnectWise Cloud Backup or Cloud Management, review service principal sign-ins in Entra ID for the app, disable the apps, and remove secrets or certificates added since 13 October.
Every app you approve is a login that never sees MFA. Count them before an attacker does.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.