Every business owner keeps a mental list of the keys that matter. The bank login, the payroll account, the alarm code for the front door. What rarely makes that list are the apps your IT provider plugged into your company email years ago. They don’t log in like a person or get a text code. They just run in the background. Most small companies outsource IT to managed service providers, or MSPs, which wire backup and security tools straight into each client’s Microsoft 365 account. Each tool holds standing permission to read and write your data with no person signing in, according to Help Net Security. For you, that’s convenience. For a hacker, it’s a skeleton key. Last week, one of those keys was stolen. Attackers took a credential for ConnectWise Cloud Backup, a tool many MSPs use to back up clients’ email and files, and used it to walk into company accounts one after another. If your IT is outsourced, this story deserves ten minutes of your week. Hackers exploited ConnectWise credentials to breach Microsoft 365 accounts, exposing businesses to lasting security risks and financial losses. SOPA Images / Getty Images What happened in the ConnectWise breach On Oct. 15, someone using the backup app’s identity started requesting access to customer accounts from a hosting-provider address, according to BleepingComputer. ConnectWise, which bought SkyKick in September 2024, disclosed the problem the next day, Techzine reported. Huntress, a security firm that watches over small businesses, saw sign-in attempts from the attackers’ address on about 1,000 Microsoft accounts, and around 300 of them succeeded, according to Security Affairs. ConnectWise disabled seven application identities on Oct. 17 and took Cloud Backup offline. It later suspended its SaaS Security and Cloud Management services too, Dark Reading reported. Related: Polymarket customer struggles to claw back funds lost to fraud On Oct. 21, Microsoft named a culprit. It said Storm-0940, a China-state-aligned group active since 2021, used an AI-driven hacking tool called ARTEX to hit more than 2,250 accounts at a pace of 2,900 sign-in attempts per minute, according to CSO Online. In several cases, the group went from picking a target to privileged access in under three hours, Microsoft wrote in its report, as quoted by Security Affairs. Most attempts failed. The ones that landed moved fast. Why a stolen key can cost you real money A backup tool has to see everything it protects. The compromised app could reach mailboxes, OneDrive and SharePoint files, Teams chats and the company directory, according to Cybernews. Email is where small business money usually disappears. Business email compromise cost U.S. victims just over $3 billion in 2025, according to an analysis of FBI data cited by Insurance Business. More Cyber Threats: Bernie Sanders sounds alarm on AI agents in your bank account Amazon caught hackers probing a PHP flaw 4 days before the fix Meta Muse closes dangerous privacy loophole after researchers exploit it The FBI logged 24,768 of those complaints VERIFY vs IC3 2025 report. By my math, that’s roughly $123,000 lost per reported case. The scheme is simple. A crook sitting in your mailbox studies how you bill, then emails a customer a real-looking invoice with new bank details, or asks your bookkeeper to update a vendor’s account. With a hijacked account, the email really does come from you. For a company with 20 employees, one diverted payment of that size can mean a missed payroll or a drained credit line. That’s the dollar stake behind a story that sounds technical. Here’s what researchers found inside affected accounts: In about 50 accounts Huntress monitors, ConnectWise management apps gave themselves directory roles, mostly Exchange Administrator, according to BleepingComputer. In at least one, a ConnectWise Teams app made itself a global administrator and, within about five minutes, added new credentials to two other trusted apps, Help Net Security reported. After getting in, the attackers changed app credentials and tried to alter privileged roles, Microsoft said, according to The Hacker News. Switching off the app doesn’t lock every door ConnectWise says its stored backup archives remain encrypted and isolated, with no sign they were touched, according to Dark Reading. The company has also said it can’t see inside customer accounts, so it can’t tell whether any one business was hit, a separate Dark Reading report noted. That leaves the cleanup to you and your provider. Microsoft warned that the attackers’ changes “can remain active as a backdoor” even after the original app is fixed, according to CSO Online. Here’s the detail I’d flag for every owner: you may be exposed even if you stopped using SkyKick years ago. ConnectWise told partners to check accounts with dormant SkyKick connections, according to Techzine, because the permission stays in place until someone removes it. Huntress also told administrators to disable the ConnectWise apps rather than delete them, and to check every app for credentials added since Oct. 13, iTnews reported. Three questions to ask your IT provider this week I asked Elli Shlomo, head of security research at Guardz, a cybersecurity company that sells to MSPs, what an owner with no security staff should actually do. He boiled it down to three questions. “First: ‘Was the ConnectWise Cloud Backup app connected to our Microsoft 365, is it disabled now, and did you check the sign-in logs for activity that didn’t come from the vendor?'” Shlomo said. “Second: ‘What changed while it was connected?'” he said. “In some tenants the app gave itself administrator rights and added new credentials to other apps, so you want a check for new admin roles, new app secrets and new mailbox forwarding rules, not just a password reset.” His third question looks past this one vendor. “Third: ‘Which other vendor apps hold this kind of access to our email and files, and when were they last reviewed?’ A good provider has already done all three and can show you the evidence,” Shlomo said. That last line is the real test. If your provider can’t hand you a written answer, you’ve learned something about who’s guarding your accounts. Ransomware crews now hunt for company backups On Oct. 20, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and international partners warned that SafePay, one of 2026’s most active ransomware crews, has hit about 600 victims since August 2024, according to HSToday. SafePay operators shut off a built-in Windows snapshot service and reset network storage drives holding backups to factory settings. In some cases they deleted every network-attached backup before negotiations began, GBHackers reported. The agencies’ fix is familiar advice with new urgency. Keep backups that are offline, encrypted and impossible to alter, and regularly test that you can restore from them, according to HSToday. There’s a practical gap to close, too. ConnectWise Cloud Backup has been paused since Oct. 17, so ask your provider whether your email has been backed up since then and when restores return. This breach will fade from the headlines. The permissions it exposed won’t, unless someone goes looking for them. Ten minutes and three questions this week could spare you a six-figure invoice scam later. For the business you’ve spent years building, that’s cheap insurance. Related: When AI attacks, who fights back?
CryptoAlerta — análise de criptomoedas e mercado em tempo real