# ConnectWise Suspends Cloud Services Following Unauthorized Access Incident Security breach forces service shutdown for MSP partners and their end-user environments. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/fd9d4856-7e31-479e-9ca4-b204f2028b98 ## Unauthorized Access Detected ConnectWise identified unauthorized access to application identities within its Cloud Backup environment on October 15. The company initiated a service interruption for Cloud Backup, formerly known as SkyKick, to mitigate risks. Integrated services, including SaaS Security and Cloud Management, were also suspended as a precautionary measure during the ongoing forensic investigation. ## Service Availability Impact As of October 18, 16:00 UTC, these services remain unavailable, preventing end-users from backing up data or accessing archives. ConnectWise asserts that existing archives remain encrypted and isolated, showing no evidence of unauthorized access. The company continues to conduct threat hunting and remediation activities to restore platform operations safely for partners. ## API Secret Compromise Security firm Huntress reported that a Microsoft 365 credential belonging to ConnectWise Cloud Backup was compromised. This API secret allegedly enabled unauthorized access to customer M365 environments. Huntress observed a ConnectWise application escalating privileges to Global Administrator, subsequently adding new credentials to other applications within the affected partner tenant environments. ## Integration Security Measures ConnectWise has disabled specific integrations between Cloud Backup and platforms like Exchange, Teams, and SharePoint Online. The company provided indicators of compromise linked to specific IP addresses and third-party integrations. However, Huntress warns that simply disabling these applications will not remove credentials already added by attackers during the unauthorized access period. ## MSP Responsibility Shift ConnectWise is urging MSPs to audit their managed M365 environments for signs of compromise. Because ConnectWise operates as a platform provider, it lacks direct visibility into the specific setups managed by its MSP clients. Consequently, the burden of identifying and remediating potential security breaches falls on the individual service providers themselves. ## End-User Visibility Challenges Many end-user organizations remain unaware of the specific platforms their MSPs utilize to deliver services. This lack of transparency creates an awkward position for businesses that are effectively oblivious to their reliance on ConnectWise. These organizations must now rely entirely on their MSPs to perform necessary security reviews and credential audits. ## Supply Chain Attack Risks Businesses serving MSPs are frequent targets for attackers seeking broad access to multiple downstream environments. Compromising a central platform provider like ConnectWise offers a high-leverage route to crack numerous partners and their respective end-users simultaneously. This incident highlights the inherent systemic risks associated with centralized management tools in the modern IT ecosystem. ## Industry Precedent Concerns The situation draws inevitable comparisons to the 2021 Kaseya attack, a notorious incident involving similar supply chain vulnerabilities. ConnectWise is currently focused on remediation and supporting partners rather than discussing threat actor attribution. The industry remains watchful, as the long-term impact of this security event on MSP trust and operations remains uncertain. ## Sources covering this story - https://www.theregister.com/security/2026/10/19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/5303758 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._