ConnectWise Cloud Backup Incident Leaves MSPs Facing Tenant Reviews and a Recovery Gap

Backup and restore services remain unavailable

ConnectWise said in its October 19 update at 01:15 UTC that Cloud Backup, SaaS Security and Cloud Management remained suspended following unauthorized access to application identities associated with its former SkyKick services. Scheduled backups, archive access and restores were unavailable, and the company had no confirmed restoration time. It said containment remained in place and it had not observed successful threat activity in environments it monitors since mitigation. That statement does not establish the status of every customer’s live Microsoft 365 tenant.

The reported scope has changed

Huntress initially reported 162 tenants with confirmed unauthorized sign-ins as of October 16 at 19:00 UTC. Its October 17 update at 5:15 p.m. Eastern reported almost 1,000 Entra tenants with sign-in activity from the associated IP address, with more than 300 showing successful activity. Those figures describe different observation stages; they are not a confirmed count of organizations whose data was stolen. Huntress also described unsuccessful attempts against 16 tenants in a separate October 15 wave. The presence or absence of an application connection affected whether authentication could succeed.

Disabling the first application is not the whole investigation

In one partner tenant, Huntress says a ConnectWise Teams-management application obtained Global Administrator privileges and added credentials to two other applications, including a tenant-specific Huntress application. Huntress says it removed the unauthorized credential on its application October 16. It could not rule out data access because available logs do not capture every read. The researchers advise disabling affected applications rather than deleting them, and reviewing credentials across applications: credentials planted elsewhere can survive disablement of the original connection.

Separate service restoration from tenant clearance

ConnectWise directs partners to review their own tenant and every managed customer tenant, including dormant connections, and keep affected applications disabled pending restoration instructions. Its guidance calls for preserving logs, examining credentials and roles, and checking mailbox changes. The company says stored archives remain encrypted and isolated, without indications of compromise; that finding concerns backup storage, not all live tenant activity. It also cautions that vendor-side actions and local tenant settings are separate controls. Administrators should use the linked, evolving technical guide for application identifiers and investigation details.

Give each client a concrete recovery assessment

Our analysis is that MSP communications should distinguish three questions: what service is unavailable, what tenant investigation has established, and what recovery option is usable now. A small business needs a named responder and a next update time. Professional-services firms should identify client work affected by the recovery gap; media businesses should assess deadline-critical production files and available independent copies. These are continuity considerations, not claims that those sectors suffered confirmed theft. Record unresolved questions explicitly, and avoid presenting a service restart as proof that every access path has been reviewed.

Related: Google Workspace Recovery and MSP Offboarding →