ConnectWise suspends three cloud services after unauthorised access in backup environment

ConnectWise suspended Cloud Backup and its linked SaaS Security and Cloud Management services after finding unauthorised access to application identities in its backup environment. The move is a precaution while the company investigates and remediates the incident; it does not by itself mean that MSPs or their customers’ systems were compromised. The outage matters because customers cannot back up data, reach existing archives or restore data through the affected services.

ConnectWise said the incident was identified on 15 October and that existing archives remain encrypted and isolated, with no evidence they were accessed. Security firm Huntress says a compromised Microsoft 365 API secret was used to access customer environments, and reports that an application in one partner’s tenant gained Global Administrator privileges and added credentials to other apps. ConnectWise has disabled some integrations and urged customers to check their Microsoft 365 environments, including application credentials; the services were still unavailable at 16:00 UTC on 18 October.