ConnectWise suspends Cloud Backup service after supply chain attack

ConnectWise confirmed on Saturday that it was investigating unauthorized access attempts related to its Cloud Backup environment. The company has suspended three cloud services—Cloud Backup, SaaS Security, and Cloud Management—as investigators assess the intrusion and test measures to prevent further access. According to the Arabian Post, attackers used compromised application credentials to access Microsoft 365 customer environments.

The service interruptions prevent scheduled backups, data restoration, and access to stored archives via Cloud Backup, which was formerly known as SkyKick. Additionally, SaaS Security monitoring and alerts are unavailable, and Cloud Management users are unable to perform normal user and license administration. To address the issue, ConnectWise disabled seven application identities on October 17 and revoked certificates associated with the affected Cloud Backup connections.

ConnectWise stated that its existing backup archives are isolated and encrypted, with no indication that attackers accessed those stored records. However, the Arabian Post noted that this assurance does not confirm whether individual customers' live Microsoft 365 environments were compromised. The company has not announced when the suspended services will resume.

Brief written by urgent.news from The Record, Arabian Post — 2 reports on this story. Machine-written — may contain errors; check the original before relying on it.