> ## Content Index
> Fetch the complete content index at: https://unhyd.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# ConnectWise Cloud Backup Incident: Seven Apps Disabled, Services Suspended
- URL: https://unhyd.com/article/connectwise-cloud-backup-incident-october-2026/
- Published: 2026-10-19T00:23:33.000Z
- Updated: 2026-10-19T00:23:33.000Z
- Description: An October 18 advisory details broader containment and service outages, while researchers warn that customer-tenant access requires a separate investigation.
- Author: Unhyd Editorial
- Tags: Technology, Cybersecurity, ConnectWise, Microsoft 365, Cloud Backup, Supply Chain Security, Incident Response

ConnectWise has expanded its response to unauthorized access involving its Cloud Backup service, formerly SkyKick, confirming in an [October 18 security update](https://www.connectwise.com/company/trust/advisories?ref=unhyd.com) that seven application identities were disabled and several related services remain offline. The company says existing backup archives are preserved and it has no evidence those archives were accessed. That assurance does not establish whether individual customers’ live Microsoft 365 environments were affected.

The ConnectWise Cloud Backup incident matters because the suspected entry point was a trusted application identity, not necessarily a stolen employee password. Security firm Huntress reported [unauthorized Microsoft 365 sign-ins](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access?ref=unhyd.com) using a compromised vendor credential and documented one customer environment in which another ConnectWise application gained elevated privileges and added credentials to other applications. The full scope and any data exposure remain under investigation.

## What changed in the October 18 ConnectWise update

ConnectWise’s advisory was first published on October 16\. The material update posted at 01:00 UTC on October 18 described a broader set of containment actions and service interruptions. The company said it had disabled seven ConnectWise application identities at 07:00 UTC on October 17, revoked certificates used for affected Cloud Backup connections and made the shared credentials previously used by Cloud Backup invalid.

That action is meant to prevent new authentication through the affected connections. ConnectWise cautions that previously issued access tokens may remain usable until expiration or other invalidation, and that separate credentials or permissions created inside a customer environment require their own investigation and removal. Disabling the original vendor identity does not automatically undo every change made before it was disabled.

Cloud Backup remains suspended, so scheduled backups are not running and access to affected backup archives and restoration capabilities is unavailable. ConnectWise also said it temporarily took SaaS Security and Cloud Management offline as a precaution, interrupting monitoring, alerting and certain user and license-management functions. The company has not provided a restoration time.

## What researchers have actually observed

Huntress said that, as of 19:00 UTC on October 16, it had confirmed unauthorized sign-ins in 162 Microsoft 365 tenants visible to its investigation. That is a dated observation from one security provider, not a final industry-wide victim count. Other reports have circulated different totals; the figure should not be treated as a comprehensive measure of all exposed or compromised organizations.

Huntress also described one customer tenant in which the ConnectWise Cloud Management application for Microsoft Teams assigned itself the Global Administrator role and added new client secrets to two other applications. Those observations indicate a possible persistence risk beyond the initially abused Cloud Backup identity. Huntress explicitly noted limits on what it could tie to the same operator and what its logs could reveal about subsequent data access.

The original suspicious authentication activity was observed on October 15, before the public advisory. ConnectWise says it identified the issue on October 14 and initiated an investigation. The October 18 update is therefore a new material response to an earlier intrusion, not the first disclosure of the incident.

## Why an application identity changes the security question

Cloud backup software needs permission to read and restore organizational data. In Microsoft 365, those capabilities can be granted to an application identity that authenticates using its own credential, rather than a human employee signing in with a password and multifactor authentication.

Microsoft’s [documentation on service-principal sign-ins](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-service-principal-sign-ins?ref=unhyd.com) explains that these application-only events are recorded separately from ordinary user logins. That distinction is central to this incident: a review confined to employee sign-in alerts can miss activity performed under a trusted software integration.

It also illustrates why organizations must treat third-party application permissions as part of their own security boundary. Unhyd’s [primer on zero-trust security](https://unhyd.com/article/zero-trust-security-baseline/) explains the broader principle: a connection that was once authorized still needs appropriately limited access and ongoing verification. Unhyd’s earlier reporting on [the Fireworks credential-rotation incident](https://unhyd.com/article/fireworks-security-incident-prompts-new-credential-rotation/) concerned a different vendor and different systems, but raised a related operational question: how quickly can exposed credentials and their dependent services be identified, contained and reviewed?

## Two separate questions: backup archives and live Microsoft 365 data

ConnectWise says its stored backup archives remain encrypted, isolated and preserved, with no evidence that they were accessed. It also says customers cannot currently restore from those archives while the affected services are suspended. Those statements concern the backup service and the copies it stores.

The potential exposure inside a customer’s live Microsoft 365 tenant is a different question. A vendor application may have access to mailboxes, SharePoint, Teams or directory information depending on its permissions. ConnectWise says it does not have the downstream visibility to determine independently whether every customer tenant experienced unauthorized activity. A clean review of limited logs cannot establish that nothing happened outside the available records.

For that reason, “no evidence of archive compromise” must not be rewritten as “no customer data was exposed.” Equally, a suspicious sign-in or the presence of a disabled app does not by itself prove that an organization’s files or email were copied. Both overstatements would mislead readers while the investigation is open.

![Process graphic showing a vendor application credential, Microsoft 365 customer access and ConnectWise's containment actions, with separate panels for preserved backup archives and still-unknown live-tenant exposure - ConnectWise Cloud Backup incident](https://storage.ghost.io/c/df/e4/dfe4d080-643c-453a-8a60-0452bdbc0efd/content/images/2026/10/connectwise-cloud-backup-containment-vs-tenant-exposure-unhyd.png)

ConnectWise says it disabled seven app identities and suspended Cloud Backup, while Huntress documented unauthorized customer-tenant sign-ins. Stored archives remain preserved according to ConnectWise, but downstream data exposure cannot be determined from that statement alone.

## What administrators should check now

ConnectWise is asking partners to examine both their own Microsoft 365 environments and customer tenants they manage, including dormant SkyKick installations. Its published guidance calls for checking the affected application connections, preserving sign-in and audit records, reviewing recent application credentials and permission changes, and investigating unexpected mailbox forwarding, inbox rules or delegated access.

Administrators should follow the [vendor’s current technical advisory](https://www.connectwise.com/company/trust/advisories?ref=unhyd.com) for the list of seven application IDs and confirmed containment instructions rather than relying on screenshots or older posts. ConnectWise says affected applications should remain disabled until it issues restoration guidance. It also warns that newly added credentials in other applications must be assessed separately.

The review belongs with an organization’s IT or incident-response team. Ordinary Microsoft 365 users should not assume that a personal account is compromised or make disruptive tenant-wide changes without authorization. Businesses relying on the affected backup service should also verify their present recovery options, because preserved archives and available restore functionality are not the same thing.

## What remains unresolved

The outstanding questions are the final number of affected customer environments, whether unauthorized actors accessed or extracted live data, whether additional application identities were abused, and when ConnectWise can safely restore Cloud Backup and the related services. The company says it has engaged outside forensic specialists and continues to review its broader environment.

The clearest lesson is not that every backup service is unsafe. It is that a highly trusted integration can become a route into many customers if its application credentials are abused. The response must therefore account for the original vendor connection, any additional permissions created afterward and the availability of recovery services. On October 18, containment is documented; the complete impact is not.