Ethical Hacking News
ConnectWise, a software as a service provider, has suspended its Cloud Backup, security, and management services following the detection of unauthorized access to its cloud-based infrastructure. The company is currently investigating the incident and has called on its customers to probe any M365 environments they manage for signs of compromise. The incident highlights the importance of proactive security measures and the need for MSPs to review their own security configurations.
ConnectWise has temporarily suspended its Cloud Backup, security, and management services following unauthorized access to its cloud-based infrastructure. The company is investigating and remedying the situation, with existing archives remaining encrypted and isolated. A security outfit, Huntress, has alleged that a Microsoft 365 credential belonging to ConnectWise Cloud Backup has been compromised. The incident raises concerns about the security of cloud-based services and the potential for unauthorized access. The company is urging its customers to review their own security configurations to prevent similar incidents.
ConnectWise, a software as a service (SaaS) provider catering to managed services providers (MSPs), has temporarily suspended its Cloud Backup, security, and management services following the detection of unauthorized access to its cloud-based infrastructure. The company, which offers various tools and services to MSPs, including cloud backup and security solutions, revealed that it had identified unauthorized access to application identities within its Cloud Backup environment on October 15.
As a precautionary measure, ConnectWise has suspended its SaaS Security and Cloud Management services, which are integrated with Cloud Backup, out of an abundance of caution while the company investigates and remedies the situation. The suspension of these services affects partners and customers using Cloud Backup, formerly known as SkyKick, and means that end-users cannot back up their data, access their archives, or restore data.
ConnectWise has stated that existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access. The company's Vice President of Security Operations, Jason Ferguson, has assured users that the company's teams are actively monitoring affected environments, conducting forensic analysis, and carrying out remediation activities.
However, security outfit Huntress has offered a starker view of the incident, alleging that a Microsoft 365 credential belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed that it is being used to gain unauthorized access to customers' M365 environments. Huntress has warned that disabling M365 apps, including the abused ConnectWise apps, will not remove credentials that were already added, and users must review the credentials on all of their M365 applications.
ConnectWise has declined to discuss threat actor attribution at this time, focusing instead on the investigation, remediation, and supporting affected partners and their customers. The company has, however, called on its customers to probe any M365 environments they manage for signs of compromise, relying on MSPs to do the right thing.
The incident raises concerns about the security of cloud-based services and the potential for unauthorized access. It also highlights the importance of proactive security measures and the need for MSPs to review their own security configurations.
In a broader context, the incident is part of a growing trend of cyber-attacks targeting cloud-based services and managed services providers. The 2021 attack on Kaseya, which compromised the security of MSPs, serves as a reminder of the potential risks and consequences of such incidents.
In response to the incident, security experts and organizations are urging users to be vigilant and take proactive steps to protect their own security configurations.
Related Information:
https://www.ethicalhackingnews.com/articles/ConnectWise-SaaS-Security-Services-Suspended-Amidst-Unresolved-Security-Breach-Investigation-ehn.shtml
https://www.theregister.com/security/2026/10/19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/5303758
https://www.imtr.net/article/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-2fb5
Published: Sun Oct 18 23:59:50 2026 by llama3.2 3B Q4_K_M
