ConnectWise Switches off Its Microsoft 365 Backup Service After Unauthorized Access
ConnectWise says it has suspended its Microsoft 365 backup service and switched off seven of its own application identities, the accounts its software uses to sign in to a client's email and files, after unauthorized access to them.
Cloud Backup, formerly known as SkyKick, copies a client's Microsoft 365 data on a schedule. In its Trust Center advisory, the company says the service is now suspended, that scheduled backups are not running, and that access to existing archives and to restores is unavailable. It has not announced a restoration date.
ConnectWise says it identified the problem on Oct. 14, 2026. It switched off the seven named identities at 07:00 UTC on Oct. 17, 2026, revoking the certificates behind the affected connections. It says the shared credentials those connections used are no longer valid, although access tokens issued earlier may keep working until they expire. Two other products, SaaS Security and Cloud Management, were taken offline as a precaution.
How far the access reached is not established. ConnectWise says its stored backup archives remain encrypted and isolated, with no evidence that they have been accessed. The company says Cloud Backup is not built to see into customers' own systems, so it cannot determine by itself whether any particular partner or customer saw unauthorized activity. It is asking IT providers to review sign-in and audit records for their own organization and for every customer account they manage, going back to Oct. 13, 2026, and to leave those connections switched off until it publishes instructions for reconnecting.
ConnectWise says it has no indication that any other product or service is affected, and that its review extends across all partner-facing services. It first published the advisory Oct. 16, 2026, and says it will continue posting updates there.
