Cybersecurity · Sunday, 18 October 2026

01 Briefing what happened

Attackers use ConnectWise's stolen backup-service key to get into at least 173 organisations' Microsoft 365 accounts

ConnectWise has shut off its Cloud Backup service after attackers signed in as the backup app itself. Because the app may read mail, files and chats to copy them, no person's login check stood in the way.

173

organisations' Microsoft 365 accounts entered with the stolen backup key

the count Huntress, a security firm, saw among the IT firms it watches [2]

2h 21m

from the first sign-in to the last, on 15 October

one internet address moved from account to account a few seconds apart [2]

90 min

how long keys already issued keep working after the app is switched off

so switching it off does not end access at once, Todyl says [2]

The lead story — what happened

ConnectWise, a company that sells software to IT firms, has shut off customer access to its Cloud Backup service after attackers got hold of the service's own key. [1]
Cloud Backup, once called SkyKick, copies the email and files of organisations that use Microsoft 365, Microsoft's online office software. To do that, it is allowed to read their mailboxes, files and Teams chats. [2]
Huntress, a security firm, says it saw confirmed break-ins at 173 organisations' Microsoft 365 accounts made with that stolen key. [2]
The sign-ins came from one internet address on 15 October, between 06:13 and 08:34 UTC, a few seconds apart. Huntress says that points to a program working down a list. [2]
The attacker signed in as the backup app, not as a person. So the second check that Microsoft 365 asks of people, a code or a tap on a phone, never came up. [1]
Todyl, another security firm, says the access could read and change mail, files and Teams chats. In the nine accounts it studied, it found only sign-ins, with no new accounts or changed passwords. [1]
Huntress saw ConnectWise's management apps give themselves administrator powers in nearly 50 accounts it watches. [1] In one account, an app made itself the top administrator and added new keys to an IT management tool and to Huntress's own security app. [2]
Microsoft confirmed attacker activity on the service and called it an active supply-chain attack, meaning an attack that comes through a supplier its victims trust. [1]
ConnectWise says it has no sign so far that the backup copies it stores were touched. [1]
Switching the app off stops new access, but keys already issued keep working for up to 90 minutes, Todyl says. [2] Keys the attacker added to other apps stay until someone removes them, Huntress says. [1]
ConnectWise tells IT staff to check the app's sign-in records for unknown addresses. Huntress advises switching the apps off and removing any keys added since 13 October. [1][2]

A person signing incode asked

The backup appno code

Microsoft 365 asks people for a second check. The backup app signed in with its own key, so no second check came up.

Who is involved

ConnectWise

a company whose software IT firms use to look after other firms' computers; it runs Cloud Backup and shut access off
Huntress

a US security firm that watches IT firms' customers for break-ins; it counted the 173 accounts
Todyl

a security firm for IT service companies; it studied nine of the break-ins
Microsoft

the maker of Microsoft 365; it confirmed the attack

How it unfolded

13-14 Oct the same address tries passwords on four law firms' accounts, with no success seen [2]
15 Oct the stolen key is used to sign in to 173 accounts in just over two hours [2]
16 Oct IT staff report strange access; Huntress confirms break-ins [1]
17 Oct Microsoft confirms it, and ConnectWise shuts customer access to Cloud Backup [1]

Where this points

Watch whether ConnectWise says how its key was taken and confirms it has been replaced, and whether any organisation finds that mail or files were copied. [1][2]

What is pushing on the whole day

The bar and the word are our reading of how hard each one is pushing today. The arrow is where it is heading. The evidence is in the stories below.

Trusted tools used to get in High↑

Attackers used the key of ConnectWise's backup service to enter 173 organisations' accounts. [2] A stolen employee login let outsiders copy code from Meta's store on GitHub, a site where programmers keep code. [3] A fake image tool on npm, a free code library, was downloaded 979 times. [10]

Hacks that reach real buildings Building↑

Dragos, a firm that guards factories, counted 1,140 ransomware incidents against industrial firms from April to June. [11] Connected fridges at a dozen US military food stores defrosted overnight in August. [12] In France, up to 700 supermarkets were hit the same way. [12]

Long gaps before anyone is told Building→

US bankruptcy notices stopped on 9 October, and the word cybersecurity was first used on 15 October. [7] Meta found its break-in weeks ago and began telling people on Tuesday. [3] An Austrian lawmaker learned last month of faked nude images of her. [13]

Governments writing new rules Building↑

Canada's C-22 bill could make tech companies build ways for police to reach users' data. [5] The EU's ban on apps that fake nude pictures is due to start on 2 December. [13]

The rest of the day

13 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

02
Backup program's updates were secretly swapped

Google's Mandiant and ManageEngine researchers say attackers tampered with the update servers of AOMEI Backupper, a program for backing up computers. [2] For five to ten minutes at a time, the servers sent harmful software instead of the real update, then switched back. [2] This ran from April to July 2026, the researchers say. [2] They link it to a new group they call UNC7017, and found victims in 11 countries, including the US, India, Spain and South Africa. [2]

Why it matters — IT firms, phone companies and universities that trusted the update were hit. It is the second backup tool reported this week as a way in. [2]
03
Meta says code and staff data were taken

Meta, which owns Facebook and Instagram, is telling about 1,500 people, most of them its own US staff, that their personal data was taken. [3] Outsiders used one employee's stolen login to get into some of Meta's code stores on GitHub, a site where programmers keep their code. [3] Meta says 99% of what they took was code, and 1% was personal data put there by mistake, against its own rules. [3] It has not said what kind of personal data it was. [3]

Why it matters — The people affected are being offered checks on their credit and on criminal websites. [3] Meta says it has changed the secret keys in those stores and added scans to catch personal data uploaded there. [3]
04
Bankruptcy notices still down after a hack

A cyberattack on BAE Systems, a British defence company, has stopped notices from every US federal bankruptcy court. [8] BAE runs the system that sends them, and notices have not gone out since 9 October. [7] A court notice on Tuesday called it a nationwide service interruption, and only on 15 October did the courts call it a cybersecurity incident. [7] The websites were still offline on Friday. [7] BAE says the problem is limited to that one system. [8]

Why it matters — Debtors and the people they owe are not getting their court notices. [9] A court in eastern Texas gave cases filed since 14 September that have a pending request to pause them an extra 30 days. [6]
05
Canada's bill could weaken scrambled messages

Canada is weighing a law called C-22 that could make tech companies, including foreign ones, build ways for police to reach users' data. [5] It could also make them keep records of what users do. [5] Signal, a messaging app that scrambles messages, says it would leave Canada if the bill passes. [5] Psiphon, a Canadian tool that helps millions of people in Iran stay online during shutdowns, says the same. [5]

Why it matters — The bill says companies will not have to build in weak spots, but opponents say any built-in way to read scrambled messages is one that others can find. [5] Apple and Meta have criticised it. [5]
06
Fake nude images of 50 European lawmakers

Lena Schilling, an Austrian member of the European Parliament, learned last month that faked nude pictures of her were online. [13] They were made from photos of one of her first press conferences, with her clothes removed by AI. [13] A report by Agora Digitale Transformation, a Berlin research group, found 50 members targeted this way, 46 of them women. [13] 119 lawmakers have signed a letter asking the EU to enforce its coming ban on such apps. [13]

46 of 50
of the 50 lawmakers targeted were women
Each dot is one targeted member of the European Parliament. The filled dots are the 46 women.

Why it matters — The EU ban on apps that undress people in photos is due to start on 2 December. [13] The letter says a ban on paper protects no one until someone enforces it. [13]
07
Ransom gangs go after building controls

Building systems run a site's heating, lights, door locks and cameras, and attackers are now using them for leverage, The Register reports. [11] Armis Labs, a security research team, found 73% of the organisations it studied own building systems of a kind already used in ransomware attacks. [11] Dragos, which guards factories, counted 1,020 ransomware incidents against industrial firms in January to March and 1,140 in April to June, partly from gangs' own claims. [11] In August, a ransomware attack upset door controls at a Canadian hospital. [11]

Jan-Mar 20261,020
Apr-Jun 20261,140
Ransomware incidents against industrial firms that Dragos counted, by quarter. Some rest on gangs' own claims.

Why it matters — When doors lock or food spoils, a victim is under more pressure to pay than when only files are stolen. [11] Dragos says fewer than one in ten factory networks is watched closely enough to spot this. [11]
08
Defrosted fridges in US military stores

Connected fridges and freezers at a dozen US military food stores on bases defrosted overnight in August, causing large food losses, the Guardian reports. [12] The Guardian sets it beside last Sunday's attack on the fridges of up to 700 French supermarkets. [12] Gerome Billois of Wavestone, a consulting firm, says France has still not put into law the EU's 2024 rules that make internet-connected devices meet security standards. [12] No group has claimed the French attack. [12]

Why it matters — Billois calls the delay on those rules a disaster. [12] He says finding the French attackers could take weeks or months. [12]
09
Fake image tool keeps coming back on npm

A harmful package called imgdecode was found on npm, a huge free library of code that programmers add to their projects. [10] It was uploaded on 30 September, downloaded 979 times, and was still online when SafeDep, a security firm, reported it. [10] It belongs to MALFEX, a campaign posting harmful packages to npm since August 2023. [10] When npm removed two of its packages on 28 September, replacements appeared within two days. [10]

Why it matters — It aims at programmers' Windows computers. [10] The newest version, posted on 11 October, no longer needs any of the packages npm removed. [10]
10
Attacks hit a web firewall used in Japan

Attackers are using a flaw in SiteGuard Server Edition, a web firewall from EG Secure Solutions, a Japanese company, The Hacker News reports. [4] A web firewall is software that screens what reaches a website. The flaw affects version 2.20 and later when a statistics setting is on, which it is by default. [4] JPCERT, Japan's computer emergency team, has warned about it. [4] Nobody has said who is behind the attacks. [4]

Why it matters — Sites running SiteGuard Server Edition with its default statistics setting are the ones exposed. [4] It is not known who has been targeted. [4]
11
Two flaws found by an AI are fixed

The Xen project, which makes software that runs many virtual computers on one machine, fixed a flaw credited to Anthropic's Claude Opus, an AI model. [4] The flaw could let a guest computer take control of the machine underneath, in all Xen versions since 4.0. [4] Samsung fixed a flaw rated 9.8 out of 10 in QA-Board, its research tool. [4] Claude Opus also flagged that one. [4]

Why it matters — Anyone running Xen can install the fix or use a setting that blocks the flaw. [4] Neither report mentions any attack using these flaws. [4]
12
New thief program aims at AI coding tools

Gen Digital, a security company, describes Warden Stealer, a new program sold to criminals that steals passwords and data. [4] It is one of the first to target the settings files of AI assistants and AI coding tools, Gen Digital says. [4] It also swaps copied cryptocurrency addresses for the thief's own. [4] Its makers change it often to avoid detection. [4]

Why it matters — Programmers who use AI coding tools keep keys in those files that open company systems and paid AI accounts. [4] Symantec says a similar program, Aoki, is already going after the same files. [4]
13
Shop software flaw has no fix yet

Rapid7, a security firm, found a serious flaw in WebAlliance eCommerce, shop software made by Channel Software. [4] It is rated 9.8 out of 10. [4] An outsider could read the shop's database, including customers' personal details and passwords, without logging in. [4] Rapid7 says no fix has been announced. [4]

Why it matters — Shops using WebAlliance, and their customers, have no fix to install yet. [4]
14
Google raises rewards for Chrome flaws

Google has raised what it pays researchers who report some kinds of flaws in Chrome, its web browser. [4] The base reward for memory-safety flaws, bugs in how a program handles memory, went from $500 to $2,000. [4] Flaws in some parts of Chrome can now earn up to $20,000. [4] Google had lowered several rewards in April. [4]

Before$500
Now$2,000
Google's base reward for a memory-safety flaw in Chrome, in dollars.

Why it matters — Researchers who find these bugs now get four times the old base reward for reporting them to Google. [4]

02 Lesson why it matters

A backup service has to read your files to protect them, so its key is a way in

A backup service cannot copy what it cannot read, so it holds standing access to the mail and files it guards, and a thief with its key gets that access too.

The twist

A tool that protects your data has to be able to reach all of it. So the program that looks safest in a company often holds the widest access.

The picture

Mail and filesread daily

Backup appholds the key

Whoever steals itsame reach

The backup app reads the mail and files to copy them. Anyone holding its key can read them the same way.

How it works

A backup service copies a firm's mail and files every day
To copy them, it is given standing permission to read them all
That permission belongs to the program, so no person's login check is asked
Whoever steals the program's key gets the same reach
So the tool meant to protect the data becomes a way to it

The same force, elsewhere today

Where this chain is also running, in today's other stories.

Backup program's updates were secretly swapped

AOMEI's update server was trusted to send new code to every copy, so a few minutes of tampering sent the attackers' code instead.
Huntress's own security app

The attacker added new keys to Huntress's app because a security tool is allowed to do a lot inside the account it guards.
Canada's bill could weaken scrambled messages

A built-in way for police to read scrambled messages would be standing access, and opponents say anyone who finds it could use it.

Where you've seen this

A cleaning firm with an office master key

it needs every door open to clean, so a copied key opens every door too

A bank's vault staff

the people who guard the money are the ones who can reach all of it

A house-sitter

to water the plants they get the alarm code, and so does anyone who reads their notes

The catch

Taking the access away breaks the protection, because a backup that cannot read the files cannot copy them. The real choice is how well the key is guarded and watched.

And the whole of it

Cloud Backup is sold to IT firms that look after other organisations' computers, so many of the 173 may never have chosen it themselves. The people whose emails sat in those accounts had no say in who held the key.

03 Truth what's really going on

What is really going on

ConnectWise's Cloud Backup was allowed to read the mail and files of the organisations that used it, so one stolen key let an attacker into 173 of their Microsoft 365 accounts in just over two hours. [2] In one account the attacker also added keys to Huntress's own security app, and this week researchers reported attackers swapping the updates of AOMEI Backupper, another backup program. [2]

Why it works on us — A backup or a security tool sounds like the safe part of a company, so few people ask how much it is allowed to see.

Who gains

Whoever holds ConnectWise's key — One stolen program key gave scripted access to many organisations at once, with no person's password or login code needed. [1][2]
Ransomware gangs that hit building systems — Locked doors and failed cooling put more pressure on a victim to pay than stolen files alone, security staff told The Register. [11]
Police and spy agencies in Canada — C-22 could let them require companies, including foreign ones, to build ways to reach users' data and to keep records of activity. [5]
Researchers who report Chrome flaws — Google's base reward for a memory-safety flaw rose from $500 to $2,000. [4]

Who pays

Organisations whose IT firm installed Cloud Backup — Their mail, files and chats could be read with the stolen key, and their backups are off until ConnectWise restores access. [1][2]
People in US bankruptcy cases — No notices have gone out since 9 October, so creditors and debtors are not told of court steps on time. [7]
Meta's own staff — About 1,500 people, most of them Meta employees, had personal data taken from code stores where it should not have been. [3]
Women in European politics — 46 of the 50 members of the European Parliament targeted with faked nude images were women. [13]
Psiphon's users in Iran — Psiphon says it would leave Canada if C-22 passes, and it keeps millions of Iranians online during shutdowns. [5]

What nobody knows yet

Open questions from across today’s stories — ours included.

01

How the attacker got ConnectWise's key.

ConnectWise says it is investigating and has not said how the key was taken or whether it has been replaced. [1]
02

How many organisations were entered.

The Hacker News reports Huntress counting 173 accounts, and BleepingComputer reports at least 162. Huntress can only see the IT firms it watches. [2][1]
03

Whether mail or files were actually copied.

Todyl found only sign-ins in the nine accounts it studied, but Huntress says some reading leaves no record at all. [1][2]
04

Who is behind the ConnectWise break-ins.

All three security firms traced the activity to one internet address, and nobody has named a group. [1]
05

When US bankruptcy notices will restart, and whether data was taken.

Neither the courts nor BAE has given a cause, a restoration date or a statement on data. [7][8]
06

What personal data was in Meta's code stores.

Meta says it was 1% of what was taken, but has not said what kind it was. [3]
07

Whether Canada passes C-22, and whether Signal and Psiphon really leave.

Canada has not passed it, and both say they would leave if it does. [5]
08

Who attacked the French supermarket fridges.

No group has claimed it. One consultant says it looks like sabotage and names Iran and Russia as countries known for such attacks, with no evidence tying either to it. [12]
09

How the EU will enforce its ban on undressing apps.

The ban is due on 2 December, and 119 lawmakers have asked for it to come with ways to enforce it. [13]

04 Hope carry this

Google now pays researchers a base reward of $2,000, four times the old $500, for reporting a memory-safety flaw in its Chrome browser.

Also true today

The Xen project and Samsung both fixed serious flaws that an AI model found, and neither report mentions any attack using them.
Meta changed the secret keys in its hacked code stores and added scans to catch personal data uploaded there by mistake.