ConnectWise Suspends Cloud Backup, SaaS Security, and Management Services to Investigate Security Incident

Overview of the Service Interruption

ConnectWise has initiated a service interruption across several of its cloud offerings after detecting unauthorized activity involving application identities within its environment. The interruption impacts partners and customers utilizing Cloud Backup (formerly known as SkyKick). Because SaaS Security and Cloud Management are integrated with the Cloud Backup infrastructure, ConnectWise suspended those services as well out of an abundance of caution while forensic investigations and remediation efforts proceed.

The shutdown was prompted by reports and security advisories indicating that threat actors accessed application identities to compromise Microsoft 365 (M365) tenants in a supply-chain incident.

• --

Interconnected Services Suspended

The suspension touches several interconnected core services in the ConnectWise cloud portfolio:

• Cloud Backup (formerly SkyKick): Application access is shut off. Scheduled backup jobs are halted, and both archive access and restoration capabilities are temporarily offline.
• SaaS Security: Temporarily paused due to deep architectural integrations with Cloud Backup. Security monitoring and alerting are currently disabled.
• Cloud Management: Taken offline alongside SaaS Security as an additional precautionary containment measure.

ConnectWise acknowledged the resulting disruption to its partner ecosystem and end clients, emphasizing that disabling these tools was necessary to contain potential threats and protect customer environments.

• --

Status of Backup Archives and Data Integrity

Addressing partner concerns over data theft and archival integrity, ConnectWise stated there is no evidence that stored partner backup data has been accessed or compromised.

Jason Ferguson, Vice President of Security Operations at ConnectWise, addressed the community via Reddit to clarify the state of customer data:

"Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access. Our teams continue monitoring affected environments, conducting forensic analysis and threat hunting, and carrying out remediation activities."

The company assured partners that existing cloud backup archives remain intact and will be accessible once operations are safely restored.

• --

Targeted Waves and Findings

While ConnectWise stated that it "cannot discuss threat actor attribution at this time" due to its focus on investigation, remediation, and partner support, external intelligence has highlighted targeted activities.

According to an update from cybersecurity firm Huntress, a second targeted wave occurred on October 15 against 16 Huntress-protected Microsoft 365 tenants spanning policy, national security, trade, and critical minerals sectors. Security analysts noted that while ConnectWise describes these service pauses as proactive measures that do not by themselves establish compromise across all environments, partners must take defensive precautions.

• --

Critical Remediation Guidance for Administrators

ConnectWise has strongly advised administrators and Managed Service Providers (MSPs) to audit the Microsoft 365 tenants they manage for signs of compromise. The company issued a critical technical warning regarding application credentials:

• Application Credentials: ConnectWise warned, "Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added. You must review the credentials on all of your M365 applications."
• Tenant Review: MSPs and administrators are instructed to inspect their environments for any unfamiliar credentials, roles, or OAuth application consents added since October 13.
• Alternative Coverage: Because monitoring, alerting, and backup operations are simultaneously offline, MSPs are urged to verify and deploy alternative monitoring and recovery safeguards until services are restored.
• --

Impact Summary Table

| Service | Status | Operational Impact |
| :--- | :--- | :--- |
| Cloud Backup | Suspended | Backups paused; restore capabilities and archives temporarily unavailable. |
| SaaS Security | Suspended | Monitoring and security alerting inactive. |
| Cloud Management | Suspended | Management capabilities taken offline out of caution. |
| Stored Archives | Preserved | Isolated, encrypted, with no evidence of unauthorized access. |