ConnectWise Suspends Cloud Backup and Related Services After Unauthorised Access

ConnectWise, which supplies software to managed service providers (MSPs), has interrupted some of its services after detecting unauthorised access. On October 16 it published an advisory saying that on the 15th it had identified unauthorised access to application identities within its Cloud Backup environment. Cloud Backup was formerly known as SkyKick. SaaS Security and Cloud Management are integrated with it, so they were also suspended as a precaution while investigation and remediation continue.

As of 16:00 UTC on October 18, the services were still unavailable. That means users cannot back up data, access archives or restore data. ConnectWise says existing archives remain encrypted, isolated and preserved, with no evidence of unauthorised access. The company says the suspension does not mean MSPs or their customers should assume they were compromised; it means ConnectWise is not confident it can run the services safely right now. It has published some indicators of compromise linked to a handful of IP addresses and third-party app integrations, and has disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online and its own products. Beyond that, it has shared little detail.

Security firm Huntress painted a starker picture. It wrote that a Microsoft 365 credential (an API secret) belonging to ConnectWise Cloud Backup has been compromised, and that it has confirmed the credential is being used to gain unauthorised access to customers' M365 environments. This is only the opening of the story, and the investigation is ongoing.