Two cybercrime stories broke within 48 hours of each other this week, and together they capture the lopsided state of the fight against digital fraud. On one side, Bloomberg detailed on October 17, 2026, how Alona Katz, chief of the Brooklyn District Attorney’s Virtual Currency Unit, spent years building a case that finally brought down a scam network spanning three time zones. On the other, Microsoft 365 customers woke up to find that a single compromised application credential tied to ConnectWise Cloud Backup, the product formerly known as SkyKick, had been used to sign into 173 tenant accounts. One story is about law enforcement finally catching up to organized fraud. The other is about how fast a supply-chain weak link can still outrun every defense built since.
Read side by side, the two stories are not really separate. They are the same war, told from opposite trenches: the multi-year grind it takes to dismantle a scam operation that drains ordinary residents’ savings, and the hours it takes for a single leaked credential to touch a backup vendor’s entire customer base. This news analysis walks through what is actually confirmed about both incidents, what remains unverified, and what the pairing says about where cybercrime enforcement and cyber defense each stand heading into 2027.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
The Brooklyn Crypto Cop Who Took Down a Global Scam Network
Bloomberg’s October 17 feature, headlined “The Crypto Cop Who Took Down a Global Scam Network from Brooklyn,” profiles Alona Katz, who leads the Brooklyn District Attorney’s Virtual Currency Unit. According to the report, Katz took over the unit three years before the operation detailed in the piece, and the investigation she oversaw eventually reached across three time zones to unravel a scam infrastructure that prosecutors say was based in Eastern Europe, including Ukraine.
The victims, according to the reporting, were Brooklyn residents who were allegedly defrauded of millions of dollars. The exact dollar figure has not been confirmed in the reporting available so far, and neither has the final legal status of every individual implicated in the scheme. That distinction matters: a prosecutor’s office announcing an operation is not the same as a conviction, and nothing in the current reporting states that anyone involved has been convicted. What is confirmed is the scope of the effort: a unit inside a borough-level prosecutor’s office, working a case that crossed continents and currencies, using blockchain tracing to connect a local fraud pattern to infrastructure thousands of miles away.
That kind of cross-border, crypto-native fraud has become the default mode for scam operations targeting US residents, and it is precisely why specialized units like the one Katz runs have become a fixture inside district attorney offices that historically focused on local crime. The Brooklyn case fits a pattern blockchain analytics firms have been documenting for years: scam proceeds move through crypto rails specifically because they are easier to shift across borders than wire transfers, and specifically because many victims do not realize funds are gone until the trail has already gone cold.
Why a Local DA’s Office Is Chasing Overseas Infrastructure
The jurisdictional reach in the Katz case is notable on its own. Brooklyn’s Virtual Currency Unit is a city-level prosecutorial team, not a federal task force, yet the case reportedly required tracing scam infrastructure located in Eastern Europe, including Ukraine, back to victims in a single New York borough. That gap between local jurisdiction and global infrastructure is becoming the norm rather than the exception for crypto-enabled fraud, and it is one reason blockchain forensics has become as central to prosecutors’ toolkits as subpoenas and wiretaps.
The ConnectWise Cloud Backup Breach: What Happened
While Bloomberg’s feature on Katz was circulating, a very different kind of story was unfolding in enterprise IT circles. ConnectWise Cloud Backup, the product line that ConnectWise acquired and rebranded from SkyKick, became the center of a Microsoft 365 credential compromise that unfolded between 06:13 and 08:34 UTC on October 15, 2026, according to incident-response firm Huntress.
During that roughly two-and-a-half-hour window, a threat actor used a compromised application credential associated with ConnectWise Cloud Backup to sign into Microsoft 365 tenants belonging to ConnectWise partners and their customers. Huntress initially recorded 162 confirmed tenants with unauthorized sign-ins as of 19:00 UTC on October 16, 2026. By the time follow-up reporting caught up, that number had climbed to 173 confirmed tenants, a figure cited by Huntress and repeated across outlets including The Hacker News.
One source IP address, 144.172.64[.]128, was identified in connection with the activity, though the identity of the threat actor or actors behind the campaign remains unconfirmed. Microsoft has acknowledged the pattern on its end, confirming unauthorized authentication attempts involving ConnectWise’s Cloud Backup service from an IP address on October 15, 2026, according to reporting from BleepingComputer.
What ConnectWise and Microsoft Have Confirmed, and What They Have Not
ConnectWise’s response has been narrow and careful about what it will and will not confirm. The company shut down Cloud Backup application access while it investigated, a move that effectively froze the product for its partner base. In a statement, ConnectWise said: “We have no indicators to date that Cloud Backup partner backup data has been compromised.” The company also said: “The existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored.”
Those two statements are doing a lot of work. They confirm that ConnectWise cut off access as a precaution, and they assert, without yet being independently verified, that the backup archives themselves were not touched. What they do not confirm is the exact quantity or type of Microsoft 365 data that may have been accessed during the window when the compromised credential was active inside those 173 tenants. That detail remains unconfirmed in the public record, and any claim that backup data was definitively compromised should be treated as unverified until ConnectWise or an independent investigator says otherwise.
Security researchers at SpecterOps, who published their own technical breakdown, framed the incident as a textbook example of how a single vendor application credential can become a skeleton key across a backup provider’s entire client roster, a dynamic documented in SpecterOps’ October 17 writeup. The Cloud Security Alliance’s research arm reached a similar conclusion in its own note, pointing out that 173 tenants compromised through one vendor app credential illustrates exactly why app-level permissions, not just user passwords, need the same scrutiny as any other identity, as detailed in the Cloud Security Alliance’s research note.
Two Timelines, One Lesson
Set the two stories next to each other and a pattern emerges that has nothing to do with the specific companies or prosecutors involved, and everything to do with the asymmetry of modern cybercrime. A scam network can run for years before a local prosecutor’s unit, working methodically across jurisdictions and blockchain ledgers, finally assembles a case strong enough to act on. A credential compromise, by contrast, can touch 173 organizations in roughly two and a half hours, and climb from 162 confirmed tenants to 173 in the span of a single day of incident-response work.
| Metric | Brooklyn Crypto Scam Case | ConnectWise Cloud Backup Breach |
|---|---|---|
| Reporting source | Bloomberg, October 17, 2026 | Huntress, ConnectWise, Microsoft, October 15-17, 2026 |
| Time to act | Roughly three years under Katz’s unit leadership | Roughly 2.5 hours of unauthorized sign-ins (06:13-08:34 UTC, Oct. 15) |
| Geographic scope | Three time zones; infrastructure in Eastern Europe, including Ukraine | 173 Microsoft 365 tenants across ConnectWise’s partner base |
| Confirmed scale | Millions of dollars allegedly taken from Brooklyn residents (exact figure unconfirmed) | 173 confirmed tenants with unauthorized sign-ins, up from 162 a day earlier |
| Named entity | Alona Katz, Brooklyn DA Virtual Currency Unit | ConnectWise Cloud Backup (formerly SkyKick) |
| Outcome so far | Scam network dismantled, per Bloomberg reporting | Cloud Backup application access suspended pending investigation |
| Unconfirmed detail | Exact dollar loss; final legal status of individuals involved | Exact data accessed; identity of threat actor; whether backup archives were touched |
The contrast is not a knock on Katz’s unit, which by all accounts ran a methodical, multi-jurisdiction investigation that most local prosecutors’ offices simply do not have the resources to attempt. It is a reminder that enforcement, even when it works, works on a different clock than attacks do. A single compromised application credential inside a backup vendor’s infrastructure does not need three years. It needs one authentication request that nobody catches in time.
Why Backup and MSP Software Keeps Becoming the Weak Link
ConnectWise occupies a specific and sensitive position in the IT supply chain. Managed service providers use ConnectWise’s product suite, including the Cloud Backup line it picked up through the SkyKick acquisition, to manage backups and recovery for hundreds of downstream small and midsize business clients at once. That concentration is exactly what makes a single compromised credential so consequential: one vendor-level application permission, if abused, can reach into every tenant that vendor touches, regardless of how well any individual customer has locked down its own Microsoft 365 environment.
This is not a new category of risk. It is the same supply-chain logic that has driven some of the most consequential breaches of the past several years, where attackers skip the hardened target entirely and go after the vendor that already has a trusted, standing connection into hundreds of downstream networks. What changes incident to incident is the specific vendor and the specific credential type, but the underlying lesson repeats: application-level credentials and OAuth-style app permissions often get far less scrutiny than user passwords and multi-factor authentication, even though they can carry equivalent or greater access.
For managed service providers and the Microsoft 365 tenants that depend on them, the ConnectWise incident is a concrete argument for treating every third-party application connection to a cloud identity platform with the same rigor as a privileged user account, including regular credential rotation, scoped permissions, and monitoring for sign-ins from unexpected IP ranges, such as the 144.172.64[.]128 address identified in connection with this incident.
Market and Industry Impact
For ConnectWise, the immediate cost is operational. Suspending Cloud Backup application access halts automated backup jobs for every MSP relying on the service, a disruption that ripples down to the small businesses those MSPs serve. ConnectWise’s statement that “the existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored” is meant to reassure partners that historical backups are safe even while the pipeline that creates new ones is offline. Whether that reassurance holds depends on findings that have not yet been made public.
The reputational cost is harder to quantify but likely larger. MSPs choose backup vendors partly on the promise that the vendor relationship itself will not become an attack vector. An incident touching 173 tenants through one vendor application credential gives competing backup and business continuity vendors a concrete talking point, and it gives MSPs already juggling vendor consolidation decisions a reason to ask harder questions about how application-level credentials are managed, rotated, and monitored across every tool in their stack.
On the enforcement side, the Brooklyn case is a reminder to insurers, compliance teams, and crypto exchanges that blockchain-tracing capability inside local prosecutors’ offices is no longer a novelty. Virtual currency units like the one Katz leads represent a growing category of state and local enforcement capacity that crypto-enabled scam operations increasingly have to account for, not just federal agencies like the FBI or the Secret Service.
Key Dates: A Timeline of the ConnectWise Credential Compromise
- October 15, 2026, 06:13-08:34 UTC: Unauthorized sign-in activity using the compromised ConnectWise Cloud Backup application credential occurs across Microsoft 365 tenants, per Huntress.
- October 15, 2026: Microsoft confirms unauthorized authentication attempts involving ConnectWise’s Cloud Backup service from the identified IP address.
- October 16, 2026, 19:00 UTC: Huntress reports 162 confirmed tenants with unauthorized sign-ins.
- October 17, 2026: The confirmed tenant count rises to 173, and ConnectWise suspends Cloud Backup application access while it investigates.
- October 17, 2026: Bloomberg publishes its feature on Alona Katz and the Brooklyn Virtual Currency Unit’s multi-year scam takedown, placing both stories in the news cycle on the same day.
Lined up this way, the ConnectWise timeline shows how little time separates a single bad authentication from a four-figure tenant count. Less than 48 hours passed between the first unauthorized sign-in and ConnectWise’s decision to cut off application access entirely, a response speed that would have been unthinkable for a vendor-level credential compromise a decade ago, and one that still was not fast enough to prevent 173 tenants from showing confirmed unauthorized activity.
Competitive Landscape: How Rival MSP and Backup Vendors Compare
ConnectWise is not the only company selling backup and remote-support tooling into the managed service provider channel, and this incident will inevitably be read by MSPs against a backdrop of other vendor-credential scares in the same space over the past few years, including prior incidents involving remote-support and IT management platforms used by thousands of MSPs. The common thread across all of them is the same: a vendor that holds standing, trusted access into hundreds or thousands of downstream Microsoft 365 or on-premises environments becomes a single point of failure the moment one application credential is mishandled.
What differentiates vendors in the eyes of MSPs evaluating their options is less about whether an incident ever happens, since the attack surface is structurally similar across the category, and more about response speed and transparency once one does. ConnectWise’s decision to suspend Cloud Backup application access entirely, rather than leave it running while investigating, is the kind of conservative response that MSPs weighing vendor risk will likely view favorably even as the disruption itself causes short-term pain for backup schedules across its partner base.
Historical Context: Supply-Chain Credential Breaches Keep Repeating
The ConnectWise incident fits a well-established pattern rather than breaking new ground technically. Over the past several years, attackers have repeatedly found that compromising a single IT management, backup, or remote-support vendor’s credentials is more efficient than attacking hundreds of individual targets directly, because the vendor relationship already carries the trust and access needed to reach downstream customers. What makes each new instance newsworthy is not the technique, which is familiar, but the scale and the specific vendor involved, since MSP and backup tooling sits at a uniquely privileged layer of enterprise IT.
On the enforcement side, the Brooklyn case also reflects a longer trend: local and state prosecutors building dedicated virtual currency and cybercrime units because federal capacity alone cannot keep pace with the volume of crypto-enabled fraud reports coming from ordinary residents. Katz’s three years leading the unit before this operation concluded is itself a data point about how long it takes to build the institutional expertise, blockchain tracing capability, and cross-border cooperation needed to bring a case like this to a close.
What Remains Unconfirmed
Both stories have real gaps that responsible reporting should not paper over. In the Brooklyn case, the exact dollar amount allegedly stolen from residents has not been confirmed in available reporting, nor has the specific legal status, such as arrest, indictment, or conviction, of every individual connected to the scam infrastructure. In the ConnectWise case, the identity of the threat actor or actors remains unconfirmed, the exact quantity and type of Microsoft 365 data accessed during the compromise window is unconfirmed, and any claim that backup archive data itself was compromised is unconfirmed, with ConnectWise explicitly stating it has no indicators of that occurring.
| Claim | Status | Source |
|---|---|---|
| 173 Microsoft 365 tenants had confirmed unauthorized sign-ins | Confirmed | Huntress, via The Hacker News |
| 162 tenants confirmed as of 19:00 UTC Oct. 16 | Confirmed (earlier count) | Huntress |
| Activity window was 06:13-08:34 UTC on Oct. 15, 2026 | Confirmed | Huntress |
| Cloud Backup archive data was compromised | Unconfirmed; ConnectWise says no indicators found | ConnectWise statement |
| Identity of the threat actor(s) | Unconfirmed | Huntress, ConnectWise |
| Exact dollar loss in Brooklyn scam case | Unconfirmed, described only as “millions” | Bloomberg |
| Legal status of individuals tied to the scam network | Unconfirmed | Bloomberg |
Treating these gaps honestly matters for a practical reason: MSPs and IT teams responding to the ConnectWise breach need to know that the absence of confirmed data-exfiltration evidence is not the same as a clean bill of health. It means investigators have not found evidence of it yet, which is a different claim than evidence showing nothing happened.
How MSPs and IT Teams Should Respond Right Now
For organizations that use ConnectWise Cloud Backup, or any MSP tooling that connects to Microsoft 365 through an application credential, the immediate priorities are straightforward even without full clarity on the breach’s final scope. Review Microsoft 365 sign-in logs for activity tied to the window between 06:13 and 08:34 UTC on October 15, 2026, and flag any sign-ins originating from 144.172.64[.]128 or unfamiliar IP ranges. Confirm with ConnectWise directly whether a specific tenant was among the 173 confirmed sign-ins, rather than assuming inclusion or exclusion. Rotate any credentials or API keys tied to the Cloud Backup integration once ConnectWise restores service, rather than reusing the same application secret that was active during the incident window.
More broadly, this is a reasonable moment for any organization to inventory every third-party application with standing access to its Microsoft 365 tenant, not just ConnectWise’s, and confirm that each one uses the minimum permission scope necessary rather than broad administrative access granted once and never revisited.
Predictions: Where Both Stories Go Next
A few outcomes look likely as both stories develop. First, expect ConnectWise to publish a more detailed post-incident report once its investigation closes, likely including a final tenant count that may still shift from the 173 figure currently confirmed by Huntress. Second, expect Microsoft to tighten scrutiny of application-level credentials tied to backup and MSP integrations across its partner ecosystem, following the same pattern it has applied after prior third-party credential incidents. Third, expect competing backup and business continuity vendors to use this incident in competitive sales conversations with MSPs currently evaluating ConnectWise, regardless of how the final investigation concludes.
On the enforcement side, expect prosecutors in other jurisdictions to point to the Brooklyn case as a model for building dedicated virtual currency units, particularly as crypto-enabled scams targeting local residents continue to outpace what traditional fraud units are equipped to investigate. Expect blockchain analytics vendors to highlight this case in their own marketing as evidence that tracing tools can support borough-level and state-level prosecutions, not just federal ones. Finally, expect continued scrutiny of exactly how much money was recovered, if any, since asset recovery in cross-border crypto fraud cases often lags far behind the public announcement of a takedown.
The Bigger Picture for 2027
Neither story resolves the underlying asymmetry between attackers and defenders, but together they show both sides of the ledger moving, just at very different speeds. Brooklyn’s Virtual Currency Unit proves that patient, cross-jurisdictional investigative work can still catch up to sophisticated crypto fraud, even when the infrastructure sits an ocean away. The ConnectWise incident proves that a single overlooked application credential inside a trusted backup vendor can still reach 173 organizations before most of them even know to look. Heading into 2027, the organizations and prosecutors making the most progress will be the ones treating both halves of that equation as equally urgent: building the enforcement capacity to catch fraud after the fact, while closing the credential-management gaps that let supply-chain attacks spread before anyone notices.
Frequently Asked Questions
What is the ConnectWise Cloud Backup breach?
It is an incident in which a compromised application credential tied to ConnectWise Cloud Backup, formerly SkyKick, was used to sign into 173 confirmed Microsoft 365 tenants between 06:13 and 08:34 UTC on October 15, 2026, according to Huntress.
Was backup data actually stolen in the ConnectWise incident?
That is unconfirmed. ConnectWise has stated it has no indicators to date that Cloud Backup partner backup data has been compromised, but the exact quantity and type of Microsoft 365 data accessed during the incident window has not been publicly confirmed.
Who is Alona Katz?
Alona Katz is identified in Bloomberg’s October 17, 2026 reporting as chief of the Brooklyn District Attorney’s Virtual Currency Unit, which led an investigation that dismantled a scam network spanning three time zones.
How much money did the Brooklyn scam network allegedly take?
Reports describe the losses as millions of dollars taken from Brooklyn residents, but the exact confirmed dollar figure has not been published.
How many Microsoft 365 tenants were affected by the ConnectWise breach?
Huntress confirmed 173 tenants with unauthorized sign-ins, up from an earlier count of 162 confirmed tenants as of 19:00 UTC on October 16, 2026.
Is my organization affected if we use ConnectWise products?
Only organizations using ConnectWise Cloud Backup with the compromised application credential are confirmed as affected. Organizations should contact ConnectWise directly to confirm whether their tenant was among the 173 confirmed sign-ins and review Microsoft 365 logs for the October 15 activity window.
Where did the scam infrastructure in the Brooklyn case come from?
According to reporting, the scam infrastructure was based in Eastern Europe, including Ukraine, and the investigation spanned three time zones before Katz’s unit brought the case to a close.
Has anyone been arrested or convicted in connection with either story?
The legal status of individuals connected to the Brooklyn scam network is not fully confirmed in available reporting, and the identity of the threat actor behind the ConnectWise credential compromise remains unconfirmed as well. Neither story currently includes a confirmed conviction.
