A report by Rocket Boys attributed sign-in activity at about 1,000 Microsoft Entra tenants and more than 300 successful sign-ins to a Huntress update dated October 17. Those figures describe authentication activity, not a count of confirmed data-theft victims. Rocket Boys’ report

What the reported login figures count

Huntress separately reported unauthorized sign-ins in 162 tenants as of October 16, 2026, at 19:00 UTC. That was an earlier snapshot with a different date and scope. NeoTeo’s earlier coverage of ConnectWise’s response covered that 162-tenant figure. Huntress’s incident analysis

A sign-in records an application’s authentication. By itself, it does not establish that the application read a message or file. The reported figures therefore describe sign-in activity, not how much Microsoft 365 data was accessed.

How the Cloud Backup app authenticated

Huntress reported that a credential held by the Cloud Backup provider was used to authenticate the application in Microsoft 365 tenants where administrators had already granted it permissions. This app-only sign-in did not require an interactive employee login, so ordinary user multifactor authentication (MFA) did not block that authentication path. Huntress’s analysis

The permissions already granted in each tenant defined what the application could access there. ConnectWise’s advisory identifies the Cloud Backup application ID as 506e08f9-6e9a-4da4-942b-a099a03644ae and says the company shut off its application access as a protective measure. ConnectWise’s advisory

A separate app changed privileges in one tenant

Huntress also reported a separate incident in one partner tenant involving ConnectWise Cloud Management – MS Teams. The app assigned itself the Global Administrator role and added client secrets to two other applications. This was a distinct app activity, not the broader Cloud Backup sign-in count. Huntress did not conclusively link the operator behind this sequence to the later sign-ins from a public IP. Huntress’s incident analysis

ConnectWise’s statement on hosted backups

In its October 17 advisory, ConnectWise said it had no indicators to date that hosted Cloud Backup partner backup data had been compromised. The company also said Cloud Backup application access had been shut off and the service interruption would continue until further notice. ConnectWise’s advisory