ConnectWise Disables Cloud Backup After Unauthorized Access to Application Identities

ConnectWise Cloud Backup was taken offline as a precaution after the provider confirmed unauthorized access to the service’s application identities on October 17. The creation of new backups is suspended until further notice. ConnectWise says the existing backup archive is expected to remain intact and that it has no indication so far that partners’ backup data was compromised.

The incident involves an application identity, not a regular user account. According to findings by security firm Huntress, attackers abused a compromised Cloud Backup/SkyKick API secret to obtain Microsoft Graph tokens. Such access could be significant especially for managed service providers and their customers with Microsoft 365 tenants.

ConnectWise Cloud Backup Is Temporarily Unavailable

ConnectWise disabled access for the Cloud Backup application as a protective measure. Customers therefore cannot create new backups through the service during the outage. ConnectWise has not yet provided details about restoring the service; further updates are expected.

The provider also published indicators that administrators should check in their environment logs. These include service-principal sign-ins for App ID 506e08f9-6e9a-4da4-942b-a099a03644ae and IP address 144.172.64.128. ConnectWise also cautioned that the mere presence of such an indicator does not automatically confirm that a specific tenant was compromised.

Huntress Confirms 162 Unauthorized Sign-Ins

As of October 16 at 19:00 UTC, Huntress reported 162 confirmed unauthorized tenant sign-ins. Security researchers described a scenario in which a compromised API secret enabled the attackers to obtain Microsoft Graph tokens. According to Huntress, the application had extensive permissions, increasing the importance of reviewing access in affected environments.

In one tenant examined in detail, Huntress found no access to emails or files. That alone does not confirm that data was not read or exfiltrated elsewhere, however. The researchers warn that some directory reads through Microsoft Graph may not create an audit trail.

Huntress also recorded privilege escalation through another ConnectWise application in one tenant. It has not been confirmed whether this occurred in other environments or whether the attackers gained more persistent access afterward.

Why This Is Not a Regular User Sign-In

The case does not involve confirmed exploitation of a software vulnerability or a traditional user sign-in. The key element was a compromised application identity and its secret. User multifactor authentication therefore cannot by itself prevent this type of access, since applications can authenticate independently using their own credentials.

For administrators, the immediate issue also includes a gap in new backups during the service outage. According to ConnectWise, existing archives are expected to remain intact, but organizations using the service need to account for the fact that new data is temporarily not being backed up through Cloud Backup.

What Administrators Should Check

• Check service-principal sign-ins associated with App ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
• Search relevant logs for IP address 144.172.64.128.
• Verify the status and coverage of current backups while Cloud Backup is suspended.
• Monitor further ConnectWise announcements about service restoration and credential-related procedures.

Whether the attackers accessed or exfiltrated customer data remains an open question. Secondary reports cited 173 affected tenants, but the currently available primary Huntress blog explicitly confirms 162 tenants. The higher figure therefore cannot yet be considered independently verified.

Verified and updated: October 17, 2026 15:21