"identified unauthorized access to application identities within the ConnectWise Cloud Backup environment," ConnectWise said in an advisory published on October 16 describing activity first detected on the 15th.
ConnectWise suspends Cloud Backup, SaaS Security, and Cloud Management
ConnectWise initiated a "service interruption" for several of its SaaS offerings after detecting what it described as unauthorized access to application identities tied to its Cloud Backup environment (Cloud Backup was formerly SkyKick). The company said the interruption affects partners and customers using Cloud Backup, and because SaaS Security and Cloud Management are integrated with Cloud Backup those services "have also been suspended out of an abundance of caution while our investigation and remediation continue."
ConnectWise said it has disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products, and has published what it called indicators of compromise that it believes are tied to a "handful of IP addresses and integrations with third‑party apps." The company also asked customers to probe any Microsoft 365 environments they manage for signs of compromise.
Huntress: a Microsoft 365 API secret was used to gain access
Security firm Huntress published a sharper assessment, saying "A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments." Huntress described one incident in which a second ConnectWise application — "ConnectWise Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640)" — granted itself Global Administrator in a partner tenant and then added new credentials to two other applications in that same tenant, one of them a single‑tenant Huntress application unique to that partner.
Huntress warned that "Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added," and advised tenants that "You must review the credentials on all of your M365 applications."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhat the immediate operational impact looks like
As of 16:00 UTC on October 18, ConnectWise said affected services remained unavailable. That outage means end users cannot back up new data, access their archives, or perform restores through ConnectWise Cloud Backup. At the same time the company emphasized that "Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access." Jason Ferguson, the company's veep of security operations, wrote on Reddit that ConnectWise teams were continuing to monitor affected environments, conduct forensic analysis and threat hunting, and carry out remediation activities.
Because ConnectWise operates as a platform provider while its MSP customers manage end‑user relationships, the firm said it has limited visibility into individual customer setups and is relying on MSPs to examine the Microsoft 365 tenants they control.
What this means for MSPs, end‑users, and procurement leaders
- MSPs: ConnectWise has explicitly called on MSPs to probe any M365 environments they manage. Huntress's advisory stresses that teams must review application credentials across all Microsoft 365 applications because simply disabling the ConnectWise apps will not remove credentials that may already have been added.
- End‑user organizations: Many will not know whether ConnectWise tools are part of their service delivery. Because MSPs are under no obligation to disclose the platforms they use, those organizations may need to ask their MSPs directly whether Cloud Backup or related ConnectWise services are in use and whether their M365 tenants have been examined.
- Procurement and continuity planners: The interruption illustrates a supplier dependency where a platform provider's outage can directly affect backup and restore capability. Organizations that rely on MSPs for packaged services should verify who manages their M365 credentials and where recovery processes sit in that supplier stack.
Supply‑chain precedent and the unanswered operational burden
ConnectWise warned it "cannot discuss threat actor attribution at this time" while it focuses on investigation and remediation. The company acknowledged limited visibility into MSP‑ and tenant‑level configurations, leaving substantial responsibility on MSPs to detect and remediate tenant compromises. The source noted that attackers frequently target businesses that serve MSPs because compromising a supplier can offer pathways to multiple downstream victims — and it cited the 2021 attack on Kaseya as a notorious example of that dynamic.
The situation is nevertheless framed by the company's insistence that archives remain encrypted and isolated and by its ongoing forensic work. Whether credentials added by a compromised ConnectWise application have been removed at scale, how broadly those credentials were used, and how MSPs will notify and remediate affected end users are the immediate operational questions ConnectWise and its partners now must answer.
