ConnectWise Cloud Backup

Reported Context (6)

ConnectWise Suspends Cloud Backup Following Unauthorized Access — ConnectWise disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained ConnectWise Suspends Cloud Backup After Unauthorized Access to Application Identities
ConnectWise is scrambling to restore its Cloud Backup, SaaS Security, and Cloud Management services after hackers abused a compromised credential to access customers’ M365 tenants. ConnectWise Suspends Cloud Services After Compromised Credential Is Used to Access Microsoft 365 Tenants
incident involves, at least in part, "a Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup" being compromised and "used to gain unauthorized access to customers' M365 environments," ConnectWise Suspends Cloud Backup Services After Stolen API Secret Enables Access to Customer Tenants
provider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users. ConnectWise Disables Application Identities After Microsoft 365 Tenant Compromise
unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. Compromised ConnectWise Credential Used to Access 173 Microsoft 365 Tenants

Malware (2)

People (4)

Threat Actors (1)

MITRE ATT&CK (9)

Vendors (5)

Products (12)

Industries (7)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.