ConnectWise has suspended its Cloud Backup service, formerly SkyKick, while investigating unauthorized access to application identities used to connect to Microsoft 365 environments. In an October 18 update, the company said it disabled seven ConnectWise application identities and revoked certificates for affected connections. The shutdown stops new authentication through those connections, but it cannot undo any changes already made inside a customer's tenant.
The interruption is substantial for partners that rely on the service: scheduled backups are not running, and access to affected archives and restoration is unavailable. ConnectWise says existing archives remain encrypted and isolated and that it has no evidence they were accessed. That statement concerns the stored backup archives; the company says it cannot determine from its own systems whether a particular customer's live Microsoft 365 environment experienced unauthorized activity.
What investigators have observed
Security firm Huntress says a compromised ConnectWise Cloud Backup application credential was used to obtain Microsoft Graph tokens in customer tenants. Its analysis confirmed unauthorized sign-ins and documented one tenant where a second ConnectWise application identity received Global Administrator privileges and added new client secrets to other applications. Huntress did not confirm mail or file access in the tenant it examined in detail. Authentication, data access and data theft are different findings and should not be treated as interchangeable.
ConnectWise says it identified the issue on October 14 and disabled seven application identities at 07:00 UTC on October 17. It subsequently suspended Cloud Backup and, as a precaution, temporarily took SaaS Security and Cloud Management offline for review. The company said it had seen no successful threat activity in environments it monitors since its mitigations, while stressing that it lacks direct visibility into downstream customer tenants. It has not announced a restoration time or established whether a product vulnerability contributed to the credential exposure.
What partners need to check
ConnectWise asks partners to review their own Microsoft 365 tenant and every managed customer tenant, including those with dormant SkyKick connections. Its technical workflow lists the affected application IDs and calls for preserving sign-in and audit records; checking service-principal activity, newly added credentials, permissions and consent grants; and examining mailbox forwarding, inbox rules and unexpected delegated access. Partners should verify that affected enterprise applications remain disabled locally while the investigation continues. ConnectWise explicitly advises against deleting them as the first response because that can destroy useful configuration evidence.
A suspicious IP address or successful sign-in warrants investigation, but neither alone proves that data was copied. Conversely, disabling the original application does not revoke separate credentials or roles an attacker may have created. Teams should also check the last successful recovery point and account for the backup gap while Cloud Backup remains unavailable. The ConnectWise Trust Center is the source for updated service status and restoration instructions.