ConnectWise Suspends Cloud Backup Services After Unauthorized Access, Credential Theft Reported

MSP software provider shuts down key tools; security firm Huntress warns of ongoing M365 compromise

By LineZotpaper

Published19 October 2026

Read Time3 min

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services after detecting unauthorized access to its systems. Security firm Huntress reports that a compromised Microsoft 365 API secret is being used to infiltrate customer environments, raising fears of a supply-chain attack affecting managed service providers and their clients.

ConnectWise, a provider of enterprise resource planning and management tools for managed service providers (MSPs), shut down its Cloud Backup service and the integrated SaaS Security and Cloud Management products after identifying unauthorized access to its systems.

In an advisory published October 16, the company said it had “identified unauthorized access to application identities within the ConnectWise Cloud Backup environment” on October 15. The discovery triggered a “service interruption” that remained in effect as of October 18. “The service interruption affects partners and customers using Cloud Backup,” the advisory stated. “Because SaaS Security and Cloud Management are integrated with Cloud Backup, those services have also been suspended out of an abundance of caution while our investigation and remediation continue.”

ConnectWise has been careful not to confirm that any customer data was accessed. Jason Ferguson, the company’s vice president of security operations, wrote on Reddit that “existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access.” The company has published indicators of compromise linked to several IP addresses and third‑party integrations, and has disabled some integrations with Microsoft Exchange, Teams, SharePoint Online, and its own products.

Security firm Huntress provided a more alarming assessment. “A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments,” the firm stated. According to Huntress, in one affected partner’s tenant, a second ConnectWise application, ConnectWise Cloud Management for Microsoft Teams, gave itself Global Administrator privileges and added new credentials to other applications, including a single‑tenant Huntress application. “Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added,” Huntress warned. “You must review the credentials on all of your M365 applications.”

The incident places MSPs and their customers in a difficult position. MSPs that use ConnectWise may not be obliged to disclose which tools they rely on, meaning end‑user organizations may be unaware their data was potentially exposed. ConnectWise has called on its partners to probe any M365 environments they manage for signs of compromise, but it has no direct visibility into those environments.

The breach is the latest in a string of supply‑chain attacks targeting MSP software, the most notorious being the 2021 Kaseya ransomware incident. ConnectWise has not attributed the attack, saying it is focused on “investigation, remediation, and supporting affected partners and their customers.”

Analysis

Why This Matters

Potential widespread disruption: MSPs and their customers rely on ConnectWise for backup and security; the interruption leaves data unprotected and may affect thousands of endpoints.
Supply chain risk: The incident echoes the 2021 Kaseya attack, where a compromise at an MSP software provider cascaded to many downstream organizations.
Credential theft raises stakes: If Huntress is correct, attackers may have persistent access to M365 tenants beyond ConnectWise’s direct suspension.

Background

ConnectWise provides enterprise resource planning and management tools tailored for MSPs, including Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management. Because MSPs serve many end‑user businesses without revealing the underlying software platforms, a breach at ConnectWise can affect organizations that are unaware they use the service. Similar incidents have targeted MSP software providers in the past, notably the 2021 ransomware attack on Kaseya.

Key Perspectives

ConnectWise: The company says it acted out of an abundance of caution, shutting down services after detecting unauthorized access. It stresses that there is no evidence that backup archives were compromised and that the investigation continues. ConnectWise has published indicators of compromise and asked MSPs to examine their M365 environments.

Huntress: The security firm warns that a M365 API secret belonging to ConnectWise has been stolen and is already being used to gain unauthorized access to customer environments. In at least one case, a ConnectWise app gave itself Global Administrator rights and added new credentials. Huntress cautions that disabling apps will not remove credentials already added and calls for thorough credential review.

MSPs and their customers: Trapped between ConnectWise’s opaque suspension and Huntress’s technical warnings, MSPs must investigate whether their tenants are affected. End‑user organizations may have no direct line to ConnectWise and must rely on their MSP to disclose risks and take remedial action.

What to Watch

Services restoration: When ConnectWise will resume Cloud Backup, Security, and Management services, and whether it can do so without compromising security.
Scope of compromise: How many MSP tenants have been accessed via the stolen API credentials, and whether any data has been exfiltrated.
Regulatory and legal fallout: Potential disclosure obligations for MSPs and ConnectWise, and possible lawsuits from affected customers.
Industry reaction: Whether other security firms corroborate Huntress’s findings or provide additional indicators.

Sources

ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU · www.theregister.com - Articles

Checked

12 claims in this story checked against 1 source: 6 supported.

Show each claim

Partly supportedHeadline: ConnectWise suspends Cloud Backup services after unauthorized access, and credential theft is reported.www.theregister.com - Articles: “A “Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised””
Partly supportedConnectWise has suspended its Cloud Backup, SaaS Security and Cloud Management services after detecting unauthorized access to its systems.www.theregister.com - Articles: ““identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.””
Not in the sourcesHuntress raises fears of a supply-chain attack affecting MSPs and their clients.
Not in the sourcesConnectWise 'has been careful not to confirm that any customer data was accessed.'
SupportedJason Ferguson, vice president of security operations, wrote on Reddit: “existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access.”www.theregister.com - Articles: ““Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access.”
SupportedThe service interruption affects partners and customers using Cloud Backup, as stated in the advisory.www.theregister.com - Articles: ““The service interruption affects partners and customers using Cloud Backup,” the company advised.”
SupportedHuntress said in a statement: “A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers’ M365 environments.”www.theregister.com - Articles: ““A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments.””
SupportedIn one affected partner’s tenant, ConnectWise Cloud Management for Microsoft Teams gave itself Global Administrator privileges and added new credentials to other applications, including a single-tenant Huntress application.www.theregister.com - Articles: ““In one Huntress partner tenant, a second ConnectWise application, ConnectWise Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640), gave itself Global Administrator and then added new credentials to two other applications in that tenant, one of them being a single-tenant Huntress application unique to this partner.””
SupportedConnectWise has disabled some integrations with Microsoft Exchange, Teams, SharePoint Online and its own products.www.theregister.com - Articles: “It has also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products.”
Partly supportedConnectWise has called on its partners to probe any M365 environments they manage for signs of compromise.www.theregister.com - Articles: “It has, however, called on its customers to probe any M365 environments they manage for signs of compromise.”
Partly supportedThe breach is the latest in a string of supply-chain attacks, the most notorious being the 2021 Kaseya ransomware incident.www.theregister.com - Articles: “The 2021 attack on Kaseya is the most notorious example of such an incident.”
SupportedConnectWise has not attributed the attack, saying it is focused on investigation, remediation and supporting affected partners and customers.www.theregister.com - Articles: “ConnectWise says it “cannot discuss threat actor attribution at this time” because it is focused on “investigation, remediation, and supporting affected partners and their customers.””