ConnectWise has pulled three Microsoft 365 services that managed service providers depend on: Cloud Backup, the product that used to be SkyKick, along with SaaS Security and Cloud Management. Someone got into app identities linked to Cloud Backup, and ConnectWise has not given a restoration time for any of the three.
ConnectWise found the problem on October 15 and first disclosed attempted intrusions on October 16. At 07:00 UTC on October 17 it disabled seven application identities, and it suspended Cloud Backup by revoking the certificates used for the affected connections; the shared Cloud Backup credentials are no longer valid. Tokens minted before the cutoff may stay valid until they lapse or are canceled some other way. Switching the identities off blocks fresh logins through those connections, but it does not roll back changes already made inside a tenant.
Two of the seven are named simply ConnectWise Cloud Backup and ConnectWise Cloud Management. The other five are Cloud Management connectors into Teams, Exchange, Graph, Partner Center and SharePoint. Because older installs may still carry SkyKick-era labels, ConnectWise says to identify each one by its application ID instead of its name.
Scheduled backups have stopped, and a technician cannot open an archive or restore a deleted mailbox or file. SaaS Security monitoring and alerting are offline, and user and license changes through Cloud Management are blocked; ConnectWise paused those two as a precaution because both are integrated with Cloud Backup. ConnectWise sells Cloud Backup as protection for Exchange, OneDrive, SharePoint, Teams, Planner, Groups and Entra ID with up to six backups a day, so each day of the suspension means up to six scheduled restore points that are never taken. A provider that ran the whole suite has lost both recovery and monitoring.
ConnectWise says its archives are still encrypted and isolated, and it has no indication they were compromised. Live Microsoft 365 tenants are a separate matter: Cloud Backup does not give ConnectWise the visibility to tell whether a given partner or customer tenant saw unauthorized activity, so the company recommends that each provider review its own tenant and every customer tenant it manages. A third-party forensics firm is assisting, and ConnectWise has seen no successful threat activity in the environments it monitors since its mitigations went in.
ConnectWise sets the start of the review at October 13 and says searches can reach back to October 1 where logs survive. Partners are asked to search sign-ins for the suspicious address 144.172.64[.]128, plus two more that ConnectWise added on October 18. They should also inspect application secrets, trust settings, admin-role changes, granted permissions, mail forwarding and inbox or transport rules. Access set up through other identities needs its own review, because disabling the original apps does not remove it. Per ConnectWise, Entra normally keeps those records for seven days on its Free tier and 30 on P1 and P2, and a license upgrade does not recover history that has already expired. The next ConnectWise update was due by 13:00 UTC on October 19.
