Updated October 18, 2026. This is a developing story and details are still changing. We will update this post as verified information comes in.
On Friday, a breach tied to ConnectWise Cloud Backup, the product formerly known as SkyKick, started making the rounds. Nobody at Pointer Tech Solutions got a call about it. No client asked us a question. We still knew about it within hours, and we had already checked every client’s Microsoft 365 environment before most business owners had heard the news.
That wasn’t luck, and it wasn’t me staying up all night. It was our team of virtual employees.
One plain statement first: Pointer Tech Solutions does not use ConnectWise Cloud Backup (SkyKick).
How AI virtual employees are changing small-business IT
For most small businesses, IT works like a fire department with a phone number. Something breaks or something scary hits the news, and you hope somebody calls somebody. Security news breaks on weekends and at night, and a small IT shop can’t have a person watching every feed around the clock.
Virtual employees change that. Here is what happened this time:
- Our news monitoring picked it up. Our team of virtual employees watches security news and industry sources continuously. It flagged the ConnectWise Cloud Backup breach as relevant to the Microsoft 365 environments we manage.
- We acted without being asked. A virtual employee, working at my direction, scanned every client tenant to confirm whether anyone was exposed. No client had to notice a headline, worry, and phone us.
- We found no real client data at risk.
I’m not going to overstate it. People still make the decisions, and they own the accountability. But the speed is the point. A check that used to wait for someone to read the news, find time, and work through each environment by hand now starts the same day the story breaks. For a small business, that is what an IT provider with a bigger team looks like.
What happened in the breach
Based on published reports from security researchers, Microsoft and ConnectWise:
- A credential for the ConnectWise Cloud Backup application, which holds broad access to Microsoft 365 data in each tenant where it is installed, was compromised.
- Starting around October 15, 2026, someone used it to sign in as the app to customer tenants. Because the app signs in as itself, user passwords and MFA prompts don’t apply.
- ConnectWise says it suspended the service and disabled seven application identities. It says it has no evidence that stored backup archives were accessed. Its investigation is ongoing.
The number of affected organizations is not settled. One security firm confirmed unauthorized sign-ins in 162 tenants as of the evening of October 16. A later update described nearly 1,000 tenants with attacker sign-in activity, more than 300 of them successful. Treat all numbers as preliminary.
A shorter checklist for your own tenant
If you ever used SkyKick or ConnectWise Cloud Backup, even years ago, an old approval may still be sitting in your tenant. A Microsoft 365 administrator can check in about 20 minutes:
- Check enterprise apps and consents. In the Microsoft Entra admin center, open Enterprise applications, remove default filters, and search for “SkyKick” and “ConnectWise.” Review which apps hold permissions or admin roles you don’t recognize. Published guidance says to disable the app, not delete it.
- Export your logs now. Entra sign-in and audit logs are kept about 7 days without Entra ID P1 or P2 licensing, and attacks began October 15, so the earliest evidence could start aging out around October 21. Use the Service principal sign-ins tab, not the default user tab.
- Call your IT provider if you find the app, see an admin role or credential you didn’t assign, or can’t export the logs confidently.
A clean result doesn’t prove nothing happened, but a saved log lets a professional review it later.
The bigger lesson
Vendor tools that connect to Microsoft 365 keep their access long after you stop paying attention, so review connected apps a few times a year. That review is part of our cybersecurity services for every client. Our AI acceptable use policy guide explains how restricting app consent keeps new tools from getting that kind of access without an administrator’s approval. Just as important, ask your IT provider how they find out about problems like this one. If the answer is “when a client calls,” that’s worth a conversation.
If you’d like a second set of eyes on your Microsoft 365 environment, talk with our team.
FAQ
Does this affect me if I never used SkyKick or ConnectWise Cloud Backup?
Probably not directly. Checking Enterprise applications confirms it.
Is backup data safe?
ConnectWise says it has no evidence that stored backup archives were accessed. The investigation continues.
Does MFA protect me?
Not against this sign-in method, because the attacker signs in as an application and user MFA doesn’t apply.
Is Pointer Tech Solutions affected?
We don’t use ConnectWise Cloud Backup (SkyKick), and we found no real client data at risk.
