CONNECTWISE SUSPENDS CLOUD BACKUP AND SECURITY SERVICES AFTER CREDENTIAL COMPROMISE EXPOSES MICROSOFT 365 ENVIRONMENTS

TAMPA, FLORIDA — IT management and cybersecurity company ConnectWise has suspended three cloud services following a security incident involving compromised application credentials that were used to gain unauthorized access to Microsoft 365 environments. The incident has triggered an investigation into the extent of the intrusion, potential administrative account compromise, and the security of customer environments managed through the company’s cloud platforms.

The disruption affects ConnectWise Cloud Backup, formerly known as SkyKick, along with SaaS Security and Cloud Management. As of October 20, 2026, all three services remained suspended while the company worked with independent forensic specialists to contain the threat, replace affected credentials, and validate its systems before restoring operations.

ConnectWise publicly acknowledged suspected unauthorized access on October 16, following suspicious activity identified earlier that week. By October 17, the company confirmed that application identities associated with Cloud Backup had been accessed without authorization and began disabling affected connections across its customer environments.

Cloud Backup provides backup and recovery capabilities for Microsoft 365 and Google Workspace data. Its Microsoft 365 integration requires access to information stored across Exchange Online, OneDrive, SharePoint, Microsoft Teams, and other cloud services. These permissions allow the backup platform to retrieve and restore customer information, but they also create significant security exposure when the credentials controlling that access are compromised.

The incident involved an application credential that could authenticate through Microsoft Entra ID and obtain Microsoft Graph access tokens. Rather than compromising individual employee passwords, the attacker exploited permissions already granted to the ConnectWise application by customer organizations.

Those permissions could provide access to email, stored files, directory information, and administrative functions, depending on the configuration of each Microsoft 365 environment.

Investigators identified unauthorized authentication activity beginning October 15 from the external IP address 144.172.64.128. The activity involved application-based sign-ins rather than conventional employee login attempts, allowing the attacker to operate through an identity that Microsoft 365 systems recognized as an authorized application.

Security investigators confirmed unauthorized application sign-ins across 162 Microsoft 365 tenants by October 16. Subsequent findings identified authentication activity from the suspicious IP address across nearly 1,000 tenant environments, with more than 300 successful sign-ins. Those observations do not establish that every organization experienced data theft or the same level of compromise.

According to security investigators, the intrusion extended beyond the original backup application in at least one documented environment. They identified activity involving a ConnectWise Cloud Management application associated with Microsoft Teams that assigned itself Global Administrator privileges and added new credentials to two other applications.

Global Administrator is among the most powerful administrative roles in Microsoft Entra ID. An attacker possessing those privileges could potentially modify application permissions, create additional credentials, alter authentication settings, and establish alternative methods of maintaining access.

The addition of unauthorized application credentials is particularly significant because removing the original compromised credential may not eliminate access established through other identities. An attacker who successfully creates additional authentication methods could retain access after the initial intrusion route has been disabled.

The broader investigation also identified attempted access involving ConnectWise applications associated with Exchange Online, SharePoint Online, Microsoft Teams, Microsoft Graph, and other cloud management functions.

A separate set of attempts targeted organizations operating in policy, national security, trade, and critical minerals. Many of those organizations did not use the affected ConnectWise products, causing authentication attempts to fail when the corresponding application identity was absent.

These findings demonstrate that the activity included both widespread authentication attempts and more selective targeting. The identity of the threat actor, the method originally used to compromise the vendor credential, and the complete extent of subsequent unauthorized activity have not been publicly established.

ConnectWise responded by revoking certificates associated with affected application connections and invalidating shared Cloud Backup credentials. The company also strengthened administrative access protections, began replacing application credentials, and engaged independent specialists to support its investigation.

The protective measures required suspending Cloud Backup operations, including scheduled backups, access to existing backup archives, and restoration functions. SaaS Security monitoring and alerting were also interrupted, along with Cloud Management functions involving user and license administration.

Although these restrictions prevent customers from using essential services, ConnectWise stated that existing backup archives remain encrypted, isolated, and preserved. The company reported no indication that the stored backup archives themselves had been compromised.

That assessment concerns the backup archives maintained by ConnectWise and does not establish that customer Microsoft 365 environments were unaffected. An attacker accessing a live Microsoft 365 tenant through authorized application permissions could potentially interact with information independently of the stored backup copies.

In its October 20 advisory, ConnectWise reported that it had observed no successful threat activity within the environments it monitors since containment measures began on October 17 at 05:00 UTC. The company acknowledged that it cannot independently determine whether every partner or customer environment experienced unauthorized access.

ConnectWise has instructed partners and customer administrators to review Microsoft Entra service principal sign-in records, application permissions, administrative role assignments, and credentials associated with affected applications. Investigators have identified the IP addresses 144.172.64.128, 144.172.64.99, and 144.172.64.60 as indicators warranting examination.

Administrators are also being directed to inspect other application identities for unauthorized credentials or changes that could permit continued access. The company has advised organizations to keep affected integrations disabled until formal restoration instructions are issued.

These precautions are especially important for managed service providers responsible for administering multiple customer environments. A compromise involving an application with access across separate Microsoft 365 tenants can expose more than one organization, depending on the permissions and management relationships involved.

As of the latest confirmed advisory, ConnectWise had not announced a restoration date. The company intends to resume the suspended services in controlled phases after completing remediation, forensic validation, and the security checks required for reconnection.

ConnectWise has reported no indication that its other products and services have been affected beyond Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management.

The incident remains under investigation, with the final number of compromised customer environments and the extent of any unauthorized data access still undetermined. For organizations using the affected integrations, restoration of ConnectWise services and verification of their individual Microsoft 365 environments remain separate security requirements.

ConnectWise, Trust Center — Advisories: Cloud Backup (Formerly Known as SkyKick) Service Interruption. Originally published October 16, 2026; updated October 20, 2026, at 00:45 UTC. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE