ConnectWise Suspends SaaS Services Following Unauthorized Access Incident
Security breach forces service shutdown as MSP platform provider investigates compromised application identities.
1Unauthorized Access Detected
ConnectWise identified unauthorized access to application identities within its Cloud Backup environment on October 15. The company initiated a service interruption for Cloud Backup, SaaS Security, and Cloud Management tools. This precautionary measure aims to facilitate ongoing forensic analysis and remediation efforts while ensuring the safety of the broader platform infrastructure.
2Service Interruption Scope
The suspension affects partners and customers relying on Cloud Backup, formerly known as SkyKick. As of October 18, 16:00 UTC, these services remain unavailable, preventing end-users from backing up, accessing, or restoring data. ConnectWise maintains that existing archives remain encrypted and isolated, showing no evidence of unauthorized access to the stored data itself.
3Credential Compromise Mechanism
Security firm Huntress reported that a Microsoft 365 credential, specifically an API secret belonging to ConnectWise Cloud Backup, was compromised. This secret allowed attackers to gain unauthorized access to customer M365 environments. In some instances, the attackers utilized ConnectWise applications to grant themselves Global Administrator privileges and add new, malicious credentials.
4Integration Security Risks
ConnectWise has disabled several integrations between Cloud Backup and platforms like Exchange, Teams, and SharePoint Online. Despite these actions, Huntress warns that simply disabling the abused applications does not remove credentials already added by attackers. MSPs must conduct a thorough review of credentials across all their managed M365 applications to ensure security.
5MSP Responsibility Challenges
ConnectWise relies on its MSP partners to investigate their respective M365 environments for signs of compromise. Because ConnectWise operates as a platform provider, it lacks visibility into the specific setups managed by MSPs. This creates a complex situation for end-user organizations that may be unaware of their reliance on ConnectWise's underlying infrastructure.
6Supply Chain Vulnerability
The incident highlights the inherent risks in the managed services supply chain. Attackers frequently target platform providers like ConnectWise, viewing them as high-value gateways to compromise numerous downstream partners and their end-user clients. This strategy mirrors the 2021 Kaseya attack, which demonstrated the massive potential impact of a single platform compromise.
7Forensic Investigation Status
Jason Ferguson, the company's vice president of security operations, confirmed that teams are actively monitoring affected environments and performing threat hunting. ConnectWise has not provided detailed attribution regarding the threat actors involved, prioritizing remediation and partner support. They have shared specific indicators of compromise related to IP addresses and third-party app integrations.
8Operational Impact Assessment
The ongoing outage forces MSPs to manage client expectations while their primary backup and management tools remain offline. The situation underscores the critical need for robust credential management and proactive security monitoring within SaaS-based ecosystems. Organizations must now verify their security posture independently to mitigate risks stemming from this platform-level service disruption.