What happened
In mid-October 2026 an attacker used a stolen credential held by ConnectWise for its Cloud Backup app (formerly SkyKick) to get Microsoft Graph tokens in customer Microsoft 365 tenants that had consented to the app, with no user password or MFA needed. On October 21 Microsoft attributed the campaign to Storm-0940, a China-state-aligned actor that used ARTEX, an open-source multi-agent AI penetration-testing framework, to run sign-ins, reconnaissance, credential changes and privilege escalation at machine speed. ConnectWise shut the service off, says restoration and phased partner re-enrollment are targeted to start October 26, and is publishing daily updates. (ConnectWise Trust Center advisory, Oct. 24, 2026)
Note on figures: The 2,250-tenant sign-in attempt count and the under-three-hours time to privileged access are Microsoft's figures. Kudelski Security reports unauthorized sign-ins in at least 162 tenants as of October 16, citing other reports.
What it means for Canada: our assessment
No Canadian victims are named, so this is an assessment. Canadian managed service providers (MSPs) and the small and mid-sized firms, clinics, law offices and municipalities they manage commonly back up Microsoft 365 through MSP tools, and any tenant that consented to the ConnectWise Cloud Backup or ConnectWise Cloud Management apps could have had mail, files or admin roles touched.
- Sectors
- Managed service providers · Small and mid-sized businesses · Law and accounting firms · Health clinics · Municipalities and non-profits · Financial services
- Tools involved
- ConnectWise Cloud Backup (formerly SkyKick), app ID 506e08f9-6e9a-4da4-942b-a099a03644ae · ConnectWise Cloud Management apps for Exchange Online, Teams and SharePoint · Microsoft 365 / Entra ID · Microsoft Graph
- Canadian rules
- PIPEDA: report breaches with a real risk of significant harm to the Privacy Commissioner, notify affected people and keep a record of every breach
Quebec Law 25: log the confidentiality incident and notify the CAI and affected people if there is a risk of serious injury
Provincial health privacy laws (for example Ontario PHIPA, Alberta HIA) if patient records sat in affected Microsoft 365 tenants
OSFI B-10 and B-13: third-party and technology risk for federally regulated financial institutions that use MSP-run backup tools
Assessment, not documented exposure. Microsoft and ConnectWise describe a global campaign across many industries and Microsoft 365 is widely used by Canadian organizations through MSPs, but no source names Canadian victims.
Takeaways for Canadian businesses
- BusinessIn the Entra admin center, find app ID 506e08f9 (ConnectWise Cloud Backup / SkyKick) and the ConnectWise Cloud Management apps, set Enabled for users to sign-in to No, and disable rather than delete them.
- BusinessCheck the Service principal sign-ins tab (not the default user sign-ins) for those app IDs, and review the unified audit log from October 13 onward for unusual mail access, file downloads, role changes or Graph activity.
- BusinessReview the credentials and secrets on every app registration and the Global Administrator role, because disabling the ConnectWise apps does not remove credentials an attacker already added.
- BusinessPreserve logs before cleaning up, follow ConnectWise's technical investigation and remediation guide, and keep the apps disabled until ConnectWise says its credentials are rotated.
- BusinessIf personal information was accessed, assess real risk of significant harm and report to the Privacy Commissioner of Canada, and report the incident to the Canadian Centre for Cyber Security through My Cyber Portal or contact@cyber.gc.ca.
For the Canadian AI sector
This is one of the first vendor-attributed cases of a state actor running a real supply chain attack with an autonomous AI agent, cutting time to privileged cloud access to under three hours in some cases, per Microsoft. Canadian AI security vendors and SOC teams should expect machine-speed OAuth and service-principal abuse, not just human-paced intrusions.
Written by AgentsNorth from the source below. General information, not legal or security advice.