Key points
- ConnectWise Cloud Backup, formerly SkyKick, is affected by the service interruption.
- SaaS Security and Cloud Management were suspended due to integration with Cloud Backup.
- No fix has been confirmed yet; services remain unavailable as of October 18.
ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services after detecting unauthorized access to application identities within the Cloud Backup environment. According to an advisory published on October 16, the company identified the breach on October 15. The suspension affects partners and customers using these tools, which are designed for managed service providers to manage customer environments.
In plain English
The Cloud Backup service protects data stored on-premises, in the cloud, or in SaaS platforms like Microsoft 365 and Google Workspace. Because SaaS Security and Cloud Management are integrated with Cloud Backup, ConnectWise paused them as a precaution. This pause does not mean customer environments are compromised. It means the vendor cannot guarantee safe operation while it investigates. Users cannot back up, access, or restore data during this time.
The background
As of 16:00 UTC on October 18, the services remained unavailable. Jason Ferguson, vice president of security operations at ConnectWise, stated on Reddit that existing archives are encrypted, isolated, and preserved. He noted there is no evidence of unauthorized access to those archives. The company is conducting forensic analysis and threat hunting. ConnectWise has also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products.
What changes now
ConnectWise published indicators of compromise linked to specific IP addresses and third-party app integrations. The company is carrying out remediation activities but has not provided a timeline for service restoration. Customers should monitor official channels for updates. The suspension is ongoing, and no patch or fix has been confirmed yet. Users must wait for the vendor to declare the environment safe before resuming normal backup and management operations.
Who needs to act first
Teams should prioritize systems with the highest exposure to external networks. Check whether any service accounts or application identities used by these tools have been rotated or restricted. Verify that backup archives are isolated from active production environments. If no fix exists, reduce exposure by limiting access to administrative interfaces. Monitor logs for unusual activity related to the affected integrations. Ensure that alternative recovery methods are documented and tested in case the primary backup service remains offline for an extended period.
Background: IP addresses
Yes, IP addresses can be traced to a specific internet service provider and general geographic region. They do not reveal your exact home address or identity. Law enforcement and network administrators use logs to link an address to a specific user account over time.
Read the full guide: Can IP Addresses Be Traced? How Visibility Works
What to do and how to stay safe: ConnectWise
- Verify if your organization uses ConnectWise Cloud Backup, SaaS Security, or Cloud Management.
- Check for any unusual activity in logs related to Exchange, Teams, or SharePoint integrations.
- Ensure that critical data has recent offline backups if possible, as cloud backups are suspended.
- Monitor official ConnectWise communications for updates on service restoration and remediation status.
Step-by-step guide: Cloud Misconfiguration Myths: 6 False Beliefs That Leave Data Exposed
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is my data in ConnectWise Cloud Backup compromised?
ConnectWise states that existing archives remain encrypted, isolated, and preserved with no evidence of unauthorized access.
When will the services be back online?
No timeline has been provided; services remain suspended as of October 18 while investigation continues.
Which specific services are affected?
Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management are currently suspended.
