Syncro’s Response to the ConnectWise SkyKick Incident

What Happened

On Friday, October 16, 2026, ConnectWise confirmed that attackers got hold of a secret key belonging to ConnectWise Cloud Backup and used it to sign in to customer Microsoft 365 tenants.

The key belonged to a multi-tenant app that MSPs had authorized in their clients’ tenants. Because the attackers signed in as the app itself, no user was involved, so multi-factor authentication (MFA) never came into play. Security researchers reported unauthorized sign-ins across customer tenants, and the full count is still unclear. In some tenants, related Cloud Management apps went further: they assigned themselves admin roles and added new credentials to other applications, so the attackers could stay in even after the original key was shut off.

ConnectWise has taken Cloud Backup, SaaS Security, and Cloud Management offline while it investigates.

Security is a team sport, and none of us is playing it alone. You, your clients, your vendors, and Syncro each hold a piece of the picture, and incidents like this one are a somber reminder that breaches can happen to any link in that chain. Whenever these types of events occur, we analyze our own security and practices against the reported attack vector and/or vulnerability.

What We’re Doing

While Syncro has not experienced a breach, our security and engineering teams are analyzing our own M365 integrations against attack vectors.

We reviewed our own integrations end to end, including code, infrastructure, and security against the techniques used in the attack.

In addition, we’re reviewing and monitoring sign-ins for our apps for activity that doesn’t look like us, such as sign-ins from unfamiliar infrastructure, new credentials appearing on an app, or an app granting itself a role. We have not found any signs of compromise or breaches.

We rotate our keys on a schedule and ensure they are only accessed where necessary, but we have decided to perform an ad hoc key rotation even though there are no signs of compromise.

How We Protect Your Data

Your Microsoft Data and Tokens

• Tokens are encrypted at rest. The access and refresh tokens we hold for each connected tenant are encrypted by the application, with a unique random salt per value, before they’re written. They live in a database separate from our main application database, and access is tightly controlled, monitored, and reviewed.
• Tokens stay out of logs. We do not ever log access or refresh tokens. Authentication errors log only Microsoft’s error code and description.
• Tokens only go to Microsoft. Our Microsoft API client sends credentials only to fixed Microsoft endpoints, and it strips any follow-on link an API returns down to a path on that same host, so a token can’t be redirected to another server.
• Integration data is encrypted at rest and in transit. The database holding Microsoft integration data is encrypted at rest and accepts only Transport Layer Security (TLS) connections. Our caches are encrypted at rest and in transit too. The Syncro Cloud Backup data is stored in your region of choice (U.S., Canada, UK, EU, or Australia) and is not able to be modified.
• That database is network-isolated. It sits in a private subnet, and only the application and our VPN can reach it.

You Stay in Control

• Access starts with your consent. Syncro connects only after a tenant administrator explicitly consents. Because our access runs through a standard Microsoft Enterprise App, an admin can review, disable, or remove it in their own Entra admin center at any time.
• Disconnect from Syncro anytime. Choosing “Remove All Integrations” disconnects your Microsoft accounts and removes the Syncro application from Microsoft. It doesn’t delete data in your Microsoft accounts. Our docs walk through it.

How Our Microsoft 365 Integration Authenticates

• Current standards. Interactive connections use the OAuth 2.0 authorization code flow with Proof Key for Code Exchange (PKCE). Our automation uses Microsoft’s current PowerShell modules (Microsoft Graph, Exchange Online, Teams, and PnP), with no legacy MSOnline or AzureAD modules and no basic authentication.
• Certificates for automated remediation. Our PowerShell automation authenticates to Microsoft 365 with certificates.

How the Platform Is Built

• Only approved actions run in your tenant. Our remediation service runs only scripts from a fixed, reviewed catalog, and a request for anything outside it is rejected. Sessions are isolated per tenant, with an explicit guard against reusing a connection across tenants.
• Secrets stay out of source code. We do not store any secrets in our source code and instead are stored in a Vault with role-based access and are delivered only to necessary workloads.
• We rotate our keys frequently. Keys are rotated on a consistent schedule.
• Secret scanning on every change. Automated secret scanning runs on every code change, before merge, to ensure no secrets are ever included in the source code
• Cluster audit logs feed our security monitoring. Audit logs from our Kubernetes clusters stream to our central security information and event management (SIEM) system, which has monitoring and alerting in place.
• A protected edge. A web application firewall protects our edge, with rate limiting on our API.
• Production and test are separate. Each staging environment uses its own Microsoft app registrations, so test systems never hold production credentials.

For More Information

• Vulnerability reports. Our security page invites researchers to report issues, and we aim to acknowledge and triage reports within 24 to 48 hours (two business days).
• Compliance commitments. Syncro is fully SOC 2 Type 2 compliant and you can learn more about our compliance standards on our compliance page.

What You Can Do Today

These steps come from guidance published by Guardz, a Syncro marketplace vendor, and from published incident reporting by ConnectWise.

1. Export your logs first. Entra sign-in and audit log retention can be as short as seven days, so save sign-in and audit logs from October 13 onward before you change anything.
2. Disable the apps; don’t delete them. In the Entra admin center, go to Enterprise applications, open Properties, and set “Enabled for users to sign-in” to No. Look for anything named ConnectWise or SkyKick (older tenants may list “SkyKick Cloud Manager”). Deleting removes the IDs you need to trace activity and forces full re-consent later.
3. Check service principal sign-ins. Use the service principal tab, not the user sign-ins tab, and look for SkyKick and/or ConnectWise Backup or Manager apps. A clean result doesn’t rule out access, so disable the app regardless.
4. Review secrets and certificates. Check all enterprise apps and app registrations for credentials added since October 13 that you didn’t create. Start with your MSP management tools, since they can reach your clients’ tenants.
5. Check directory roles. Remove any role held by a ConnectWise or SkyKick service principal that you didn’t intentionally grant, especially Global Administrator.
6. Look for persistence. Check for new inbox rules, mail forwarding, unauthorized app registrations, added client secrets, and changed permissions.
7. Remember tokens outlive the switch. Disabling an app stops new tokens, but tokens already issued stay valid until they expire (roughly 60 to 90 minutes). Revoking user sessions doesn’t end app-based access.
8. Keep the apps disabled until ConnectWise confirms the compromised credentials have been rotated, then repeat these steps in every client tenant where the apps are consented, starting with the most sensitive.

Share

• Share on Facebook
• Share on X
• Email this Page