The SkyKick Incident: What Your IT Provider Should Be Doing Now

You can train your staff to recognise suspicious emails. You can protect their accounts with stronger sign-ins. But what happens when the compromised access belongs to a supplier your business already trusts?

A supplier incident can put your information at risk without an employee clicking a link or approving a fraudulent sign-in. It raises a different question: who is watching the systems and connections that your business relies on?

As at 19th October 2026, Konnetix has not been affected by this incident. We are discussing it because it is a timely reminder that security is about more than choosing well-known products. It also depends on how those products are managed and what happens when a supplier reports a problem.

What Has Been Confirmed About SkyKick?

ConnectWise has confirmed unauthorised access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. In its early-morning update on 19th October, it reported that Cloud Backup, SaaS Security and Cloud Management remained suspended while investigation, remediation and security validation continued.

Separately, Huntress has documented unauthorised access to customer Microsoft 365 environments involving credentials belonging to trusted vendor applications. Those connections can have significant permissions because they need access to perform tasks such as backing up or managing business information.

There is an important distinction here. ConnectWise has reported no evidence that its encrypted backup archives were accessed. That does not establish whether individual customers' live Microsoft 365 environments were affected. An interruption to a service is also not, by itself, proof that every customer has been compromised.

The investigation is ongoing. Businesses should follow the current ConnectWise guidance with their IT or security provider rather than rely on a headline or assume that an absence of visible problems means there is nothing to check.

Why Staff Training and MFA Are Not the Whole Answer

Multi-factor authentication remains an important protection for people signing in. However, applications can authenticate using their own credentials without a person entering a password or responding to an MFA prompt. An attacker who obtains a valid application credential may be able to use permissions already granted to that application.

This does not make MFA or staff awareness less valuable. It shows why security needs several layers, including oversight of third-party access. Watching employee sign-ins alone does not provide a complete view of application activity.

Five Things Your IT Provider Should Be Able to Explain

1. Which Suppliers Have Access, and Why?

A managed service provider should understand which applications and supplier connections are authorised, what they can do and who is responsible for them. Access should have a business purpose and be reviewed when services change. Removing unnecessary access can reduce exposure, but changes need to account for the systems and services that depend on it.

2. What Is Being Monitored Beyond Employee Sign-Ins?

Ask whether monitoring covers relevant application sign-ins, changes to permissions and unexpected credentials, as well as activity involving users and devices. Endpoint protection, user sign-in monitoring and application identity monitoring are not interchangeable. Your provider should explain the actual coverage, any limitations and who investigates an alert.

3. What Happens When a Supplier Reports a Compromise?

There should be a clear process for assessing exposure, following vendor guidance, containing affected connections and investigating changes in the environments being managed. Simply changing a staff password or disabling one application may not remove access established through other credentials or identities. Huntress and ConnectWise both highlight the need for a wider review in this incident.

Containment is not the same as a completed investigation. A good response distinguishes between stopping new access, checking for activity that has already happened and validating when it is safe to reconnect a service.

4. How Would a Supplier Outage Affect Recovery?

A backup can exist and still be temporarily unavailable for restoration. ConnectWise's updates describe interruptions to both new backup jobs and access to restores. Recovery planning needs to consider service dependencies, gaps in protection and what can realistically be recovered during an outage, not just whether a backup was previously completed.

5. How Will Customers Be Kept Informed?

Businesses need clear explanations of what is known, what is still being checked and whether they need to take action. Your provider should avoid both unnecessary alarm and premature reassurance. Someone should own the response and keep you informed as reliable information becomes available.

Where Complete 365 Fits In

Complete 365 is Konnetix's fully managed IT, cyber security and business assurance service. It brings day-to-day support, Microsoft 365 security management, device protection, backup and recovery planning, and ongoing oversight into one service.

It includes 24/7 Managed Detection and Response, backed by a Security Operations Centre, with human analysts investigating alerts and helping contain genuine threats. Alongside security configuration, regular reviews and management of the wider IT environment, this supports an approach that looks for problems rather than simply waiting for a customer to report one.

The purpose is to reduce avoidable risks, identify suspicious activity earlier and support a coordinated response. No managed service can guarantee that a third-party incident will never affect a customer. Monitoring scope, access permissions and recovery arrangements still need to be understood for each business.

That is the conversation worth having: not whether a provider can promise nothing will ever happen, but whether they can explain the protections in place, the limits of those protections and who will act when something changes.

Do Not Wait for Your Own Supplier Alert to Ask

This Cyber Security Awareness Month, ask your IT provider which third parties can reach your data, what activity is monitored and what the response would involve if one of those connections became unsafe.

Your business does not need a promise of perfect security. It needs clear responsibility, controls that can be explained and a response that does not depend on you spotting the problem first.