On October 15, one stolen key signed in to at least 162 companies' Microsoft 365 accounts, one after another, seconds apart. That's the count from Huntress, the security firm that investigated it.

The key didn't belong to an employee. It belonged to an app.

ConnectWise Cloud Backup, formerly called SkyKick, is a backup tool. IT firms install it for the businesses they look after. To back up everything, it was allowed to read everything: email, OneDrive files, SharePoint, Teams chats and the company directory.

Now think about your own phone. Somewhere on it is an app you tapped "Allow" on years ago. A fitness tracker. A photo editor. A "Sign in with Google" button. You never thought about it again.

It never stopped having access.

Companies do exactly the same thing. Except their "Allow" covers every inbox in the building.

So when that one key was stolen, the attacker didn't need to break into 162 companies. Those companies had already let it in.

Here's the part most people miss. Apps log in too.

They sign in as themselves, with their own secret key. No username. No phone. No MFA prompt. (MFA is the extra code you get after your password.) MFA was built to stop a stranger using a person's password. There's no person here to stop.

And one key worked against every company that had ever approved the app. Microsoft says the attacker "likely abused permissions previously granted by customers."

Then the attacker started copying keys.

In one company, a ConnectWise management app quietly made itself a Global Administrator, the highest role in Microsoft 365. Within about five minutes, it added brand-new secret keys to two other trusted apps. One of them was Huntress's own security app. The new keys were set to keep working until 2028.

Read that again. The burglar didn't just use the master key. He cut spare copies and hid one on the security company's keyring.

ConnectWise has since disabled seven of its app identities and suspended its Cloud Backup, SaaS Security and Cloud Management services while it investigates. It says it has found no evidence that customers' stored backups were accessed. The root cause hasn't been made public.

So was anyone's email read? Here's the uncomfortable answer: many companies will never know.

Huntress says some of the directory lookups the app can make leave no audit trail at all. Blumira, another security firm, says records of mailbox access depend on how each company set up its auditing, and the detailed app-activity logs only exist if a company switched them on before the attack, with a paid license. Blumira also says Microsoft's built-in policy controls for app logins don't cover third-party apps like this one.

And the risk reaches further back than you'd think. Blumira says it applies to any company that ever installed the backup tool, "including tenants that stopped using it years ago." Approval doesn't expire. It lasts until someone removes it.

Even pulling the plug isn't instant. According to Todyl, access passes the app already holds keep working for up to 90 minutes after it's disabled.

Huntress also saw a separate, targeted wave the same day: 16 organizations working on policy, national security, trade and critical minerals.

Yes, ConnectWise lost the key. That's on them. But the reason one key opened 162 companies is that each of them handed a vendor permanent, unwatched access to everything, and then forgot about it. We spent ten years teaching people to protect their logins. Meanwhile the logins that aren't people quietly became one of the widest-open doors in the building, and almost nobody is watching them.

Who's really at fault here: the vendor that lost the key, or the companies that handed out a master key and never checked it again? And have you ever found an app connected to your accounts that nobody remembered approving?

Identity Decoded publishes every week at identity-decoded.com