The Backup Vendor Had the Keys. So Did the Attacker.

The October 2026 ConnectWise incident exposes a dangerous blind spot in cloud security: trusted applications can become privileged intruders without triggering the authentication controls designed to protect employees.

A security team can require phishing-resistant authentication, review every administrator account, and still find an intruder inside its cloud environment without a single employee signing in. That sounds contradictory until you look at the software identities trusted to work on the organization’s behalf. Backup platforms, management tools, and integrations often hold permissions that ordinary users would never receive. They authenticate as applications, not people, and their access can stretch across many customers. When one of those credentials is stolen, the blast radius follows the trust relationship rather than the company directory.

That is the uncomfortable lesson of the ConnectWise Cloud Backup incident disclosed in October 2026. Huntress reported unauthorized application sign-ins on October 15 and confirmed activity in 162 Microsoft 365 tenants by the evening of October 16. Investigators traced the activity to a credential belonging to the backup service, formerly SkyKick, which was used to obtain Microsoft Graph access tokens. Because the application was already authorized in customer tenants, the…