In mid-October 2026, a popular backup tool used by IT companies — ConnectWise Cloud Backup, which many still know by its old name SkyKick — was hacked. The way it happened is a wake-up call for every business owner, because it’s a reminder that you can do everything right in your own business and still be put at risk by a tool your IT provider uses behind the scenes.
Here’s the plain-English version — and, more importantly, the simple questions it should make you ask your own IT provider.
What happened, in plain English
Cloud Backup is a tool that copies a business’s Microsoft 365 data — email, files, Teams — so it can be restored if something goes wrong. To do that, it’s given a trusted “key” into each customer’s Microsoft 365.
Attackers managed to steal that key. With it, they could get into customers’ Microsoft 365 as the backup tool itself. Three things make this one stand out:
- No one was tricked into handing over a password. The attackers didn’t need to phish a member of staff — they used the tool’s own key.
- Multi-factor authentication (MFA) didn’t stop it. MFA protects people logging in. This wasn’t a person logging in, so it walked straight past.
- The tool already had wide access. So once they were in, they could potentially reach email, files and chats.
Hundreds of businesses had their Microsoft 365 accessed this way before it was shut down.
Where things stand
ConnectWise reacted quickly — they switched the tool off, cut off the stolen key, and brought in security specialists. As things stand, the service is still turned off while they make it safe again. In practice that means anyone relying on it can’t run backups or restore files right now, and there’s no firm date yet for it coming back.
The better news: the stored backups themselves look to be safe. But every affected business still needs its Microsoft 365 checked properly — switching the tool off doesn’t automatically undo anything the attackers may have already done.
Why this matters to you
This is what’s called a “supply-chain” attack, and the lesson is simple: your security is only as strong as the tools your IT provider plugs into your systems. You might never have heard of ConnectWise or SkyKick — but your provider chooses tools like these on your behalf, and each one is a trusted door into your business. If the company behind that door gets hacked, the door can be walked through — passwords and MFA included.
That’s exactly why the questions below matter.
The questions to ask your IT provider
You don’t need to be technical to ask these. A good provider will have clear, calm answers — and won’t mind you asking.
- “Do we use ConnectWise Cloud Backup or SkyKick — and are we affected?” They should be able to answer yes or no straight away, not go away and wonder.
- “Have you actually checked our Microsoft 365, or are you assuming we’re fine?” There’s a big difference between “we don’t think so” and “we’ve looked and confirmed it.”
- “What other outside tools are connected to our Microsoft 365?” You want them to know, and to be able to show you, every trusted connection into your systems.
- “How would we know if something like this was happening to us?” You want a provider who watches for it — not one who finds out from a LinkedIn post.
- “If one of these tools got hacked, how fast could you spot it and shut it down?” This attack ran for days before it was caught.
If the answers are vague, slow or defensive, that tells you something. It’s also a good moment to revisit the wider warning signs in our post on how to tell your IT provider has changed hands.
What to do now
For most business owners, the action here is refreshingly simple: ask your IT provider the questions above, and expect a straight answer. If you use ConnectWise Cloud Backup or SkyKick — or you’re not sure — ask them to check your Microsoft 365 and confirm, in writing, that you’re in the clear. The technical side is their job, not yours.
Where we stand
Here’s the short version for anyone we look after: Snap IT doesn’t use ConnectWise Cloud Backup (formerly SkyKick). It isn’t connected to any of the Microsoft 365 accounts we manage — so none of our clients are affected, and there’s nothing you need to do.
We can say that with confidence for two reasons. We keep the tools we plug into client systems deliberately tight, and we check what’s connected to every account we manage. And — just as importantly — our last line of defence is Huntress, the very security firm that caught this breach and raised the alarm. They watch over our clients’ Microsoft 365 around the clock for exactly this kind of attack: the sort that slips past passwords and MFA.
The bottom line
This breach is a sharp reminder that modern attacks don’t always come through your front door. Sometimes they come through a side door your IT provider installed and trusted. That’s not a reason to panic — it’s a reason to ask good questions, and to expect clear answers. If you don’t get them, that’s worth paying attention to.
