ConnectWise Suspends Cloud Backup and Related Services After Detecting Unauthorized Access
ConnectWise halted its Cloud Backup, SaaS Security, and Cloud Management platforms on October 16 to investigate a security breach involving compromised application identities.
Key points
- ConnectWise suspended services on October 16 after finding unauthorized access to application identities within its Cloud Backup environment on October 15.
- The outage affects partners and customers using Cloud Backup, formerly known as SkyKick, along with integrated SaaS Security and Cloud Management tools.
- The company has disabled specific integrations with Exchange, Teams, and SharePoint Online while conducting forensic analysis and threat hunting activities.
ConnectWise initiated a service interruption for its Cloud Backup, SaaS Security, and Cloud Management offerings on October 16 following the detection of unauthorized access. The managed services provider (MSP) software vendor published an advisory stating it identified the breach of application identities within the Cloud Backup environment on the preceding day, October 15.
The suspension impacts partners and customers relying on Cloud Backup, which was formerly known as SkyKick. Because SaaS Security and Cloud Management services are integrated with Cloud Backup, ConnectWise suspended those platforms as a precautionary measure. The company stated it lacks confidence in operating these services safely while its investigation and remediation efforts continue.
Incident Details and Response
As of 16:00 UTC on October 18, the affected services remained unavailable, preventing end-users from backing up data, accessing archives, or restoring information. Jason Ferguson, ConnectWise’s vice president of security operations, posted on Reddit that existing archives remain encrypted, isolated, and preserved. He noted there is no evidence of unauthorized access to those stored archives.
ConnectWise has provided limited details regarding the intrusion but published indicators of compromise linked to specific IP addresses and third-party app integrations. The company disabled integrations between Cloud Backup and Microsoft Exchange, Teams, SharePoint Online, and its own proprietary products to contain the potential threat.
Impact on Users
The service interruption does not indicate that MSPs or their end customers have confirmed compromises within their own environments. ConnectWise clarified that the shutdown is a safety measure rather than a confirmation of widespread data theft. Users cannot currently perform backup operations or data restoration tasks through the ConnectWise platform.
Forensic analysis and threat hunting are ongoing as the security team monitors affected environments. The company continues to carry out remediation activities to address the unauthorized access to application identities. No timeline for service restoration has been provided in the initial advisory.
What should you do?
Security professionals should verify if their organization uses ConnectWise Cloud Backup or its integrated SaaS Security and Cloud Management tools. Monitor for any unusual activity in Microsoft 365 or Google Workspace environments that may indicate lateral movement. Review access logs for any unexpected integrations or third-party app permissions granted recently.
What to do and how to stay safe: ConnectWise
- Check if your organization relies on ConnectWise Cloud Backup, SaaS Security, or Cloud Management services for data protection or identity management.
- Review Microsoft 365 and Google Workspace admin logs for unauthorized application permissions or suspicious sign-in attempts from unknown IP addresses.
- Verify the status of existing data archives and ensure alternative backup mechanisms are active while ConnectWise services remain suspended.
- Monitor official ConnectWise communications and security advisories for updates on remediation progress and service restoration timelines.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ConnectWise services are currently suspended?
ConnectWise has suspended Cloud Backup, SaaS Security, and Cloud Management services due to detected unauthorized access within the Cloud Backup environment.
Are customer data archives compromised?
ConnectWise states that existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access to the stored data.
When will the services be restored?
The source material does not provide a specific date or timeline for the restoration of ConnectWise services as investigations and remediation continue.
