CONNECTWISE suspended its Cloud Backup (formerly SkyKick) on 17 October 2026 and, after continuing investigations, extended the temporary shutdown to SaaS Security and Cloud Management. The actions come as the company addresses unauthorized access to application identities within the Cloud Backup environment, with the aim of protecting partners and clients.
The disruption has halted scheduled backups, archive access and restores, and has affected Cloud Security monitoring and license management across affected services. ConnectWise has not provided an estimated restoration timeline, but says that customer backups remain encrypted and protected and there is no evidence of unauthorized access to those backups.
Independent investigators from Huntress say the compromise involved a vendor credential used to access Microsoft 365 tenants. They report that the Cloud Backup credential authenticated to 162 Microsoft 365 tenants between 15–16 October, with activity traced to the same IPs involved in earlier password-spraying attempts.
Huntress notes the attacker’s use of Microsoft Graph tokens and that, in at least one tenant, the ConnectWise Cloud Management app for Teams gained Global Administrator privileges before the attacker added new client secrets to MSP and Huntress applications. Sign-in activity from the attacker’s IP address grew to nearly 1,000 Entra tenants by 17 October, though access depended on the specific presence of the ConnectWise service principals in each tenant.
ConnectWise has published related advisories and guidance for reviewing Microsoft 365 configurations, while stating that the threat has been contained and that customers must verify there was no persistence or configuration changes in their environments.