ConnectWise Suspends Cloud Backup Services After Unauthorized Access

What changed

ConnectWise suspended Cloud Backup, formerly SkyKick, along with its integrated SaaS Security and Cloud Management services after identifying unauthorized access to application identities on October 15. As of 16:00 UTC on October 18, users could not back up data, access archives or restore files.

Why it matters

This is a service outage in the part of the stack meant to make recovery routine. Managed services providers and their customers can still have existing archives, which ConnectWise says remain encrypted, isolated and preserved, but those archives cannot currently be reached or used for restoration.

ConnectWise also disabled some integrations with Exchange, Teams, SharePoint Online and its own products while it investigates. That makes the incident broader than a single paused backup console: connected tools are being treated as part of the same security boundary.

The sharper warning comes from Huntress, which alleges that a compromised Microsoft 365 API secret belonging to Cloud Backup was used to access customer environments. In one partner tenant, Huntress said a ConnectWise application obtained Global Administrator privileges and added credentials to two other applications. ConnectWise has not established whether customer environments were compromised, and the threat actor, scope and root cause remain undisclosed.

For now, the practical lesson is uncomfortable but clear: turning off an abused application may not remove credentials it already created. Any organisation managing Microsoft 365 through these ConnectWise services needs to review application credentials across its environment while the investigation continues.