An attacker walked straight into Microsoft 365 tenants through a backup application this week, and the chain runs through the managed service providers that keep small hospitals and clinics online.
ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after finding unauthorized access to application identities inside that environment. Microsoft confirmed unauthorized authentication attempts from a single IP address on October 15. Huntress counted at least 162 compromised tenants in its own book of business.
The mechanics matter. The backup app signed in using its own service principal and stored secret, not a human account, so multi-factor authentication never entered the conversation. Because clients had already granted that application broad Entra ID permissions, each sign-in carried read and write access to mail, attachments, OneDrive, SharePoint files, and Teams chats. Huntress watched Cloud Management service principals assign themselves Exchange Administrator roles across nearly 50 tenants.
Why clinics sit in the path
Community hospitals, rural health centers, and specialty practices overwhelmingly outsource email, identity, and backup to MSPs. An application identity with tenant-wide mail access is functionally a patient correspondence archive: scheduling threads, referral packets, lab results pasted into messages, insurance correspondence with member IDs attached.
Covered entities stay liable for the acts of their business associates under HIPAA. A compromise that begins entirely inside a vendor environment does not transfer the notification clock.
What to do now
Pull Entra ID sign-in logs for all service principal authentication over the past 30 days. Inventory every third-party app holding application-level permissions and cut mail scope where it is not required. Review which applications hold Exchange Administrator roles. Rotate secrets on backup connectors. Ask your MSP whether it uses ConnectWise Cloud Backup and whether those identities have been revoked.
ConnectWise reported no indicators that partner data was compromised.
