What happened?
ConnectWise says it identified the issue on October 14 and investigated unauthorized access to application identities linked to Cloud Backup. On October 17 at 07:00 UTC, it disabled seven application identities and suspended the service by revoking certificates for affected connections. Backups and restores are temporarily unavailable.
Unauthorized Microsoft 365 sign-ins
Huntress confirmed unauthorized sign-ins in 162 Microsoft 365 tenants by 19:00 UTC on October 16, within its monitored population. This is not a total count of affected organizations. In at least one investigated tenant, application credentials and permissions were modified. MFA on user accounts cannot by itself prevent authentication using a compromised application credential.
Are existing backup archives affected?
ConnectWise says its Cloud Backup archives remain encrypted, isolated and preserved, with no evidence so far of unauthorized access to the archives. This does not establish that downstream customer Microsoft 365 tenants were unaffected: customers need to review their own logs. Archived backup data cannot currently be restored during the outage.
Five useful checks
1. Inventory ConnectWise and SkyKick enterprise applications in Microsoft Entra, including old connections. 2. Review service principal sign-in logs, not only user sign-ins. 3. Examine newly added secrets, certificates, permissions and privileged roles across affected applications. 4. Investigate unexpected mailbox rules, forwarding and data access. 5. Review recovery time requirements and prepare independent continuity options where justified.
Why disabling an app is not enough
Disabling affected connections prevents fresh sign-ins through them, but it does not automatically undo credentials, permissions or access that an attacker might have added earlier. Follow vendor guidance and your security investigation before restoring affected connections.
The lesson for small organizations
A reliable backup plan must account for archive integrity, service availability, actual restore capability and third-party application permissions. TechAtelier’s diagnostic and monitoring tools can help track digital service health, but they do not replace an Entra investigation or independent backup strategy.
Sources
Status as of October 18, 2026. Investigation ongoing; refer to current vendor guidance.