{"id":1518,"date":"2026-10-19T12:14:33","date_gmt":"2026-10-19T17:14:33","guid":{"rendered":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/?p=1518"},"modified":"2026-10-21T17:03:58","modified_gmt":"2026-10-21T22:03:58","slug":"connectwise-breach-managed-it-services-las-vegas","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/blog\/connectwise-breach-managed-it-services-las-vegas\/","title":{"rendered":"ConnectWise Breach: Managed IT Services Las Vegas Must Act"},"content":{"rendered":"
\n
⚠ Cybersecurity Alert<\/div>\n

Managed IT Services in Las Vegas: The ConnectWise Cloud Backup Breach Put Microsoft 365 Tenants at Risk<\/h2>\n
A stolen vendor credential let attackers sign in to hundreds of Microsoft 365 environments without a single password or MFA prompt.<\/div>\n
Published by CMIT Solutions of Las Vegas \u00b7 Cybersecurity \u00b7 6 min read<\/div>\n<\/div>\n

What Happened to ConnectWise Cloud Backup (Formerly SkyKick)<\/h2>\n

On October 15, 2026, ConnectWise identified unauthorized access to application identities inside its Cloud Backup<\/strong> environment, the product formerly known as SkyKick. Cloud Backup is used by IT providers to back up Microsoft 365 data for their small-business customers. Security firm Huntress reported that a credential belonging to that app was being used to sign in to customer Microsoft 365 tenants.<\/p>\n

Huntress confirmed unauthorized sign-ins in 162 tenants by October 16. By its October 17 update, almost 1,000 Entra tenants showed sign-ins from the attacker’s IP address and more than 300 of them succeeded. ConnectWise has disabled the affected apps, suspended Cloud Backup, and, as a precaution, suspended SaaS Security and Cloud Management. As of October 18, those services were still down. No threat actor has been named, and ConnectWise says it cannot discuss attribution yet.<\/p>\n

If you are searching for managed IT services in Las Vegas<\/strong>, or you already have a provider, this is the incident that should shape your questions. The tool you trusted to protect your data became the way in.<\/p>\n

\nKey Takeaway<\/span>
\nThe attackers did not guess passwords or beat MFA. They used a trusted vendor app identity, which signs in with no user, no device, and no MFA prompt. Your own security settings never got a vote.<\/em>\n<\/div>\n

How the Attack Worked<\/h2>\n

Microsoft 365 lets approved apps connect to your tenant with their own permissions. That is how backup, security, and management tools do their jobs. It is also why a compromised vendor secret is so dangerous. Here is what Huntress documented:<\/p>\n