On 19 October 2026 ConnectWise, one of the largest suppliers of software to IT support companies, wrote to its partners about a security incident in its Cloud Backup service. Cloud Backup is the Microsoft 365 backup product that used to be called SkyKick, and many IT providers in the UK use it to back up their clients’ email, OneDrive and SharePoint.
If your IT provider uses it, this matters to you. If you are a QLine IT client, the short version is: your Microsoft 365 backup runs on CloudAlly, not ConnectWise Cloud Backup or SkyKick, and we have already checked every client tenant we manage. The rest of this article explains why.
What happened?
ConnectWise says it found unauthorised access to the “application identities” behind Cloud Backup. In plain English, these are the keys a backup service uses to log in to a customer’s Microsoft 365 so it can copy their mailboxes and files. Whoever holds those keys can reach the same data the backup service can.
ConnectWise’s own notice says its investigation is ongoing, that some partner environments may have been affected, and that it cannot rule out unauthorised access to live Microsoft 365 environments. It has told partners to assess their own tenant and every customer tenant that might be affected.
ConnectWise has taken these steps so far:
- It has disabled and revoked the affected application identities, so they can no longer be used.
- It has taken its SaaS Security product offline as a precaution while the review continues, which means its monitoring and alerts are not running.
- It has told partners not to reconnect any ConnectWise or SkyKick application, and that when the service returns everyone will have to register again.
ConnectWise also makes an important point: switching off the connection stops further access, but it does not undo anything an attacker may already have changed inside a tenant. That has to be checked tenant by tenant, by whoever manages it. Current updates are on the ConnectWise Trust Center.
Why this kind of breach is serious
A backup service needs wide access to do its job. To copy every mailbox and every SharePoint site, it is usually given permission to read all of them. That makes a backup supplier a very attractive target: break into the supplier once, and you may be able to reach hundreds of businesses at the same time.
This is called a supply chain attack, and it is why we are careful about which suppliers we connect to our clients’ systems, and how much access we give them.
QLine IT clients: what you need to know
We use a different backup system. We back up our clients’ Microsoft 365 with CloudAlly, supplied through AppRiver. It is a separate company and platform from ConnectWise, with its own separate access to your tenant, and it was not part of this incident. Your backups are still running as normal. You can read more on our Microsoft 365 email and SharePoint backup page.
We have checked every client tenant under our control. We did not wait for ConnectWise to finish its investigation. On the morning the notice arrived, we checked every client Microsoft 365 tenant we manage:
- ConnectWise and SkyKick apps: we checked the apps connected to every tenant, including old or unused ones left over from previous providers. None of our clients has a ConnectWise or SkyKick app connected, so none was exposed through this incident.
- Mail forwarding and inbox rules: we reviewed forwarding settings and inbox rules across every tenant. These are the first things an attacker sets up after getting into a mailbox, and they are on ConnectWise’s own checklist.
- Audit logging: we have made sure Microsoft’s audit log is switched on and stays on, so there is a full record to investigate if anything like this happens again.
- Administrator accounts: we are reviewing accounts with full admin rights and removing any that are no longer needed.
None of this found any link to the ConnectWise incident.
You do not need to do anything. There is nothing to reset and no action needed on your side. If anything changes, we will contact you directly. If you are a client and would like a summary of what we found in your own tenant, just ask.
Not a QLine IT client?
If your IT provider uses ConnectWise Cloud Backup, SkyKick or ConnectWise SaaS Security, ask them these questions now:
- Has our Microsoft 365 tenant been checked for unauthorised access since the incident was announced?
- Have any ConnectWise or SkyKick connections to our tenant been removed, including old ones?
- Who is monitoring our tenant while ConnectWise SaaS Security is offline?
- Are our backups still running, and where are they now?
If you do not get clear answers, or you are not sure who has access to your Microsoft 365, contact us and we will help you find out.
What can we learn from this?
- Every supplier connected to your systems is a way in. Know which ones have access, and remove the ones you no longer use.
- Give each supplier only the access it needs, and review it regularly.
- Backup is essential, but the backup system needs protecting as carefully as the data it holds.
- Plan your response before anything happens. The businesses that cope best with incidents like this are the ones whose provider already knows exactly what is connected where.
IT Solutions
QLine IT is Cyber Essentials Plus accredited and a Microsoft Solutions Partner. We look after businesses, charities and children’s homes across Leeds and the UK. If you would like your Microsoft 365 checked, or a backup that does not depend on the supplier in the headlines, speak to us.
