ConnectWise Breach: Managed IT Services Las Vegas Must Act

What Happened to ConnectWise Cloud Backup (Formerly SkyKick)

On October 15, 2026, ConnectWise identified unauthorized access to application identities inside its Cloud Backup environment, the product formerly known as SkyKick. Cloud Backup is used by IT providers to back up Microsoft 365 data for their small-business customers. Security firm Huntress reported that a credential belonging to that app was being used to sign in to customer Microsoft 365 tenants.

Huntress confirmed unauthorized sign-ins in 162 tenants by October 16. By its October 17 update, almost 1,000 Entra tenants showed sign-ins from the attacker’s IP address and more than 300 of them succeeded. ConnectWise has disabled the affected apps, suspended Cloud Backup, and, as a precaution, suspended SaaS Security and Cloud Management. As of October 18, those services were still down. No threat actor has been named, and ConnectWise says it cannot discuss attribution yet.

If you are searching for managed IT services in Las Vegas, or you already have a provider, this is the incident that should shape your questions. The tool you trusted to protect your data became the way in.

How the Attack Worked

Microsoft 365 lets approved apps connect to your tenant with their own permissions. That is how backup, security, and management tools do their jobs. It is also why a compromised vendor secret is so dangerous. Here is what Huntress documented:

• The entry point: a credential that lives in the vendor’s own tenant. Customers could not have created it, leaked it, or rotated it.
• No MFA involved: app-only sign-ins have no user or device, so MFA and most user-focused Conditional Access rules never apply.
• Privilege escalation: in some tenants, the ConnectWise Cloud Management app assigned itself directory roles, mostly Exchange Administrator. In one tenant it granted itself Global Administrator.
• Persistence: in that tenant, the app then added new client secrets to two other applications. Those secrets expire in 2028, so simply disabling the ConnectWise apps does not remove them.
• Targeting: Huntress saw password spraying against law firm tenants and probing of organizations in policy, trade, and critical minerals, though the broader targeting is unclear.

One more detail matters: Microsoft Graph directory reads leave no audit trail. Huntress found no mail or file access in the one tenant it examined closely, but a clean log does not prove a clean tenant.

What This Means for Las Vegas Businesses

Las Vegas runs on small and mid-sized firms that depend on one outside IT provider and Microsoft 365: medical and dental practices, law offices, contractors, property managers, and the vendors serving the Strip. Most of them cannot tell you which apps have standing access to their tenant. That is the gap this incident exploited. For managed IT services in Las Vegas, the question is no longer just who monitors your network, but who monitors the tools that monitor your network.

• ⚠Client email and files: a rogue Exchange or SharePoint role can read mail and documents without anyone logging in.
• ⚠Regulated data: healthcare, legal, and government-contractor firms may have breach notification duties if access to protected data cannot be ruled out.
• ⚠Your backups: with Cloud Backup suspended, affected businesses may have no restorable copy of their Microsoft 365 data right now.
• ⚠Lingering backdoors: secrets added to other apps keep working after the original vendor apps are shut off.
• ⚠Business email fraud: mailbox access is the raw material for invoice scams and fake payment-change requests.

Three Steps to Take Now

Defending Las Vegas with CMIT Solutions

CMIT Solutions of Las Vegas supports Southern Nevada businesses with 24/7 monitoring, Microsoft 365 security, and straight answers when something like this breaks. Whether you are with us or another provider, we will review your tenant’s app permissions and tell you exactly where you stand. Good managed IT services in Las Vegas should hold their own vendors to the same standard as everyone else.