ConnectWise Resets App Credentials as M365 Backups Stay Offline

The incident began when threat actors used a compromised vendor credential to sign in as the SkyKick app, gaining access to 173 customer and partner tenants. Security researchers warn the breach could impact hundreds of Microsoft 365 tenants, exposing emails, files, and directory data, with the risk extending to downstream customers of managed service providers. There are further concerns that attackers established persistence by adding credentials to other applications, potentially allowing them to survive the current identity reset.