If your IT company backs up your Microsoft 365 email and shared files with ConnectWise Cloud Backup, the product that used to be called SkyKick, that backup hasn’t run since October 17. Ask them today whether you’re on it. The headlines this week are about an AI-run attack. What lands on a small business is plainer: the safety copy of your work is switched off.
I pulled ConnectWise’s own advisory page at 10:05 UTC this morning, October 23. It carries 19 updates since October 16. These are the ones that matter, in order:
- Saturday the 17th: ConnectWise says it is “shutting off Cloud Backup application access,” which “will interrupt backup services for customers until further notice.”
- Sunday the 18th: “Scheduled backups are not running.” Also: “We do not have a restoration time to share yet.”
- Tuesday the 20th: scheduled backups, archive access and restores “remain unavailable,” along with two sister services for security alerts and license changes.
- Wednesday the 21st: restoring begins in phases, with a warning that “the start of restoration does not mean all capabilities are available.”
- Today, in the 01:00 UTC update: getting old backups back comes first, “early next week.” Setting the service up again comes after that.
That’s six days with no new backups so far. If “early next week” means Monday the 26th, it’s nine days before anyone can pull an old copy out. The page doesn’t name a day. The old copies are said to be fine: “Existing backup archives remain encrypted, isolated and preserved, with no indication of compromise.” What’s missing is anything newer than the 17th.
Two Counts That Get Mixed Up
One headline this week calls this an “AI-Run Attack That Reached 2,250 Tenants”. A tenant is one company’s own space inside Microsoft 365. Two numbers are floating around, and they count different things.
| Number | What it counts | Who says so | When |
|---|---|---|---|
| 162 | Tenants with confirmed unauthorized sign-ins | Huntress | 19:00 UTC, October 16 |
| Over 2,250 | Tenants the attackers tried to sign in to | Microsoft | October 21 |
Microsoft says most of that targeting failed. So 2,250 is how many doors got rattled, not how many opened. The 162 was Huntress’s count on the first day, and I don’t know what it is now.
Nobody can hand you your own number, either. ConnectWise says it “cannot determine through our investigation alone whether a particular customer’s Microsoft 365 environment experienced unauthorized activity.” The answer for your company sits in your own sign-in logs.
What the AI Changed
Microsoft says the group behind this used ARTEX, an open-source tool that can run any AI model to automate break-in work, and that in several cases it went from first target to privileged access in under three hours. ConnectWise repeats that, saying the group “used an openly available agentic AI framework to automate and speed up its operation.”
That’s the AI part: speed. The way in was old. Huntress, writing on October 16, says the stolen item was a vendor credential: “the credential lives in the vendor’s own tenant. Nothing a customer did in their environment could have produced it.” Its post doesn’t mention AI at all.
I couldn’t load Microsoft’s page directly, only through a summarizing tool, so I’m repeating its numbers and checking them against news reports that match. On the AI claim it’s one source, Microsoft, with ConnectWise relaying it.
A faster attacker means less time between a stolen key and an open mailbox. It doesn’t change the thing you can check. Which outside apps can sign in to your Microsoft 365 without a person at the keyboard?
What to Ask Your IT Person Today
Do you know who runs your backup? Plenty of owners don’t, and that’s normal. One email covers it:
- Is our Microsoft 365 backed up with ConnectWise Cloud Backup or SkyKick? If so, what’s backing it up this week?
- Have you checked the sign-ins for that app? ConnectWise points admins to the Entra admin center (Microsoft’s list of who and what can sign in), under Monitoring, Sign-in logs, on the Service principal sign-ins tab, filtered by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. The default user tab won’t show it.
- Is the connection disabled but not deleted? ConnectWise says to keep affected connections disabled until it gives instructions, and Huntress says to disable the app, not delete it.
If the answer to the first question is no, nothing on ConnectWise’s page says you’re affected.
If you’d rather talk it through, the free thirty-minute call is open. Bring one question about who can get into your accounts.