GoKawiilConnectWise Disables Cloud Backup Product After Microsoft 365 Credential Breach
ConnectWise disclosed that a threat actor used credentials tied to its Cloud Backup product (formerly SkyKick) to authenticate into Microsoft 365 tenants, discovering unauthorized access to application identities on Oct. 14. The company has since disabled Cloud Backup, SaaS Security, and Cloud Management for partners and clients while an incident response firm investigates, leaving backup, restore, and monitoring functions unavailable.
GoKawiil's interpretation of the reporting above, not reported fact.
Because Cloud Backup requires broad permissions into customers' Microsoft 365 and Entra environments, including mailboxes, OneDrive, SharePoint, and Teams, a compromise here could expose sensitive data across many downstream managed service providers and their clients. Security researchers appear divided on how far the breach extends, suggesting the true scope and impact may not be known until ConnectWise's investigation concludes.
- ConnectWise found unauthorized access to app identities linked to its Cloud Backup product on Oct. 14.
- The company disabled Cloud Backup, SaaS Security, and Cloud Management, halting backups, restores, and monitoring.
- No vulnerability exploitation or attacker attribution has been confirmed as the investigation continues.
Source: darkreading.com — Alexander Culafi, 2026-10-19
Published there as: “ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.