ConnectWise Cloud Backup Halted After App Identity Compromise; Archives Secure

ConnectWise initiated a service interruption for its Cloud Backup platform following the detection of unauthorized access to application identities. The company, which provides enterprise resource planning tools for managed service providers, discovered the intrusion on October 15. This identity compromise triggered a precautionary suspension of integrated services to prevent further exposure while the vendor conducts forensic analysis and remediation efforts.

Root cause

The incident stems from unauthorized access to application identities within the ConnectWise Cloud Backup environment, formerly known as SkyKick. According to The Register, the company published an advisory on October 16 detailing the breach. ConnectWise stated it lacked confidence in operating its services safely during the investigation. The source material does not specify whether the access resulted from credential theft or a software vulnerability.

Attack path

Attackers accessed application identities within the ConnectWise Cloud Backup environment. ConnectWise subsequently disabled specific integrations between Cloud Backup and Microsoft Exchange, Teams, and SharePoint Online. The vendor also severed connections with its own internal products and third-party applications. These actions aim to isolate the compromised identities and limit potential exposure while the investigation continues.

Affected versions

The suspension impacts all partners and customers using ConnectWise Cloud Backup. Because SaaS Security and Cloud Management are tightly integrated with the backup service, those platforms were also suspended out of an abundance of caution. There is no distinction made between specific software versions; the outage affects the entire service tier associated with the compromised identity layer.

Mitigation

• Monitor ConnectWise communications for updates on service restoration timelines.
• Verify that existing data archives remain encrypted and isolated.
• Review third-party application permissions in connected environments.
• Disable unnecessary integrations with backup providers temporarily.

Detection notes

Security operations teams should monitor for anomalous API calls from backup service identities. Look for unexpected permission changes or new integrations added to SaaS platforms. Check authentication logs for sign-ins from unfamiliar IP addresses or at unusual times. Investigate any alerts regarding application identity resets or token revocations. Containment typically involves revoking compromised tokens and disabling outbound API connections to limit lateral movement.

Background: Microsoft Exchange vulnerabilities

Exchange servers are not inherently unpatchable, nor are they only targets for nation-states. The real risks come from delayed updates, weak internal segmentation, and misconfigured authentication. Correcting these operational gaps reduces exposure more effectively than buying expensive add-on tools.

Read the full guide: Microsoft Exchange Vulnerabilities: 6 Myths That Put Your Data at Risk

What to do and how to stay safe: ConnectWise

• Audit all third-party application permissions in Microsoft 365 and Google Workspace.
• Review logs for unusual activity from backup service accounts.
• Ensure data archives are encrypted and access is restricted.
• Wait for vendor confirmation before restoring full integration access.

Step-by-step guide: MFA for Cloud Accounts: 8 Practices to Prevent Credential Theft

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Was any customer data stolen?

ConnectWise stated there is no evidence of unauthorized access to existing archives, which remain encrypted and isolated.

When will services return?

The company has not provided a specific restoration date, only that services remain unavailable as of October 18.

Which services are affected?

Cloud Backup, SaaS Security, and Cloud Management are suspended due to their integration with the compromised backup environment.