ConnectWise reports unauthorised access to Cloud Backup credentials; Microsoft links the compromise to its Storm-0940 cluster
Reported2 distinct origins, 0 independent.
ConnectWise published an advisory on a Cloud Backup (formerly SkyKick) service interruption on 16 October and later said it had identified unauthorised access to application credentials associated with the service, with no indication that backup archives or other products were compromised. Microsoft said on 21 October it assesses that the actor it calls Storm-0940, which it describes as China-state aligned, was responsible, and that the activity targeted hundreds of organisations globally, with ConnectWise-related sign-in attempts reaching more than 2,250 tenants. No government attribution was found.
- When
- 16 October 2026
- Where
- No fixed place, No single country
- What
- cyber, software supplier
- Attribution
- Not attributed. Only Microsoft names an actor: it assesses that Storm-0940, Microsoft's own label for a cluster it describes as China-state aligned, was responsible. No government has attributed it and China has not been found to answer.
- In the record
- Published 2026-11-09 22:52 UTC · backfilled
Sources
- Evidence ConnectWise
we identified unauthorized access to application credentials associated with Cloud Backup, formerly SkyKick.
- Corroboration Microsoft
Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise
History
- First recorded 9 Nov, 22:52 UTC, as reported (origins from one side only).
Cite or reuse
The War Record, "ConnectWise reports unauthorised access to Cloud Backup credentials; Microsoft links the compromise to its Storm-0940 cluster", record ev-20261109-bmxp, version 1, https://thewarrecord.com/events/ev-20261109-bmxp/