Your backup tool can read every mailbox. This week someone else did.

· · Security

If an outside IT company looks after your Microsoft 365, there is a good chance it also backs it up. To do that, the backup service is given permission to read every mailbox, every OneDrive, every SharePoint site, and every Teams chat in your business, and to write to them so it can restore things. That is not a flaw. A backup that cannot read your data cannot back it up.

It does mean the backup tool holds one of the largest sets of keys anyone has to your business. This week, somebody else picked them up.

What happened at ConnectWise

ConnectWise Cloud Backup, which many IT providers still know by its old name, SkyKick, backs up Microsoft 365 and Google Workspace for the businesses those providers look after. The security firm Huntress reported on 16 October that the application's own credential had been stolen. The credential lives with ConnectWise, not with its customers.

On 15 October, between 06:13 and 08:34 UTC, someone used it from a single hosting address to sign in to customer Microsoft 365 setups, moving through them a few seconds apart in what looks like a script working down a list. By the evening of 16 October, Huntress had confirmed unauthorised sign-ins in 162 of them. Later reporting put the figure at 173, and Huntress has since seen sign-in activity from the same address in almost 1,000.

Two details matter for anyone who thinks their setup is well protected:

  • Two-step verification did not apply. The attacker signed in as the application, not as a person. There was no user, no device, and no code to type.
  • It did not stop at reading. In one customer setup Huntress examined, a second ConnectWise application made itself Global Administrator, the highest level of control in Microsoft 365, and then added new credentials to two other trusted applications. Those credentials keep working until someone removes them, whatever ConnectWise does on its side.

ConnectWise has shut down application access for its partners and their clients and says it has "no indicators to date that Cloud Backup partner backup data has been compromised". It has not said how the credential was taken. Microsoft has described the incident as an active supply chain attack. Huntress's position is blunt: some of what an application reads in Microsoft 365 leaves no record, so a clean log does not prove nothing was taken.

A second backup tool, a different route

The same week, Google's threat intelligence team and Mandiant published an investigation into AOMEI Backupper, Windows backup and disk-cloning software that an IT person may have installed on a PC or server years ago.

Between April and July 2026, attackers repeatedly changed the files on AOMEI's own update servers for five to ten minutes at a time, then changed them back. Any copy of Backupper that checked for an update during one of those windows downloaded and ran a backdoor. Nobody had to click anything. ManageEngine's researchers, who first caught it on two customers' machines on 28 May, note that the program did not properly check that the update files were genuine.

AOMEI told Mandiant on 29 July that it had secured its servers. That fixes the source. It does not clean a machine that was already infected, and because the files were only wrong for minutes at a time, checking AOMEI's website today tells you nothing. The confirmed victims were in 11 countries, not including the UK, but Google says the real number is likely higher.

Why this keeps happening to backup tools

In both cases the customers did nothing wrong. Their passwords were fine, their two-step verification was on, and their software was up to date. The access came through a trusted supplier's product, using exactly the permissions it was given to do its job.

You cannot make a backup tool need less access. What you can control is whether you know which ones you have, whether someone can switch one off quickly, and whether you would hear about it when the supplier has a bad week.

What to do today

For the director, questions for your IT provider:

  • Do we use ConnectWise Cloud Backup, or anything else from ConnectWise or SkyKick, in our Microsoft 365?
  • If so, have you disabled it in our setup and checked for administrator roles or credentials it added since 13 October? "ConnectWise has switched it off" is not the same answer.
  • While the backup is off, our Microsoft 365 is not being backed up. What covers the gap?
  • Is AOMEI software installed on any of our computers or servers?

A good provider will already have answers. If yours is hearing about this from you, that is worth noting too.

For whoever looks after Microsoft 365, the steps Huntress recommends:

  1. In the Microsoft Entra admin centre (the identity system behind your Microsoft 365 accounts), open Enterprise applications and search for "SkyKick" and "ConnectWise". The backup application's ID is 506e08f9-6e9a-4da4-942b-a099a03644ae. Older setups may list the management apps as "SkyKick Cloud Manager".
  2. For each one, open Properties and set "Enabled for users to sign-in" to No. Disable it, do not delete it: deleting removes the consent and you will have to set it up again later. Existing backups held by ConnectWise are not deleted.
  3. Remove any administrator role these applications hold that you did not deliberately grant, especially Global Administrator.
  4. Review the client secrets and certificates on all your enterprise applications and app registrations, not just ConnectWise's, for anything added since 13 October that you did not create. Remove it. Microsoft's guide to reviewing application permissions covers where to look.
  5. If you want to check the logs, use the Service principal sign-ins tab under Sign-in logs, not the default user tab, and filter by the application ID above. Look for the address 144.172.64.128.
  6. Do not re-enable anything until ConnectWise confirms all its credentials have been reset.

If AOMEI Backupper is installed anywhere, look in Task Scheduler for tasks named RadminComponentRuntime or NitroRuntime. If you find one, treat the machine as compromised and get help. Updating or removing AOMEI does not remove the backdoor.

How Steelwise can help

Working out which suppliers' applications can read all of your mail and files, and how quickly each could be switched off, is a short and well-defined review. If you think you were affected this week, get in touch and we will help you check.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.