ConnectWise suspended Cloud Backup after unauthorized use of its application identities

The advisory is the suspension

ConnectWise's trust-center page, updated Sunday, October 18, 2026, says the company is still investigating unauthorized access to application identities used by Cloud Backup, formerly SkyKick. The update says Cloud Backup was suspended after unauthorized activity. Because SaaS Security and Cloud Management are integrated with that backup, those services were suspended too. Backup jobs, archive access, and restores are unavailable. So are security monitoring and alerting, and user and license management in Cloud Management. Partners are the audience. The advisory is the record of what the vendor turned off.the advisory is the story.

Archives and live tenants are different questions

The company says existing backup archives remain encrypted and isolated, and that it has no indication those archives were compromised. It then draws the line this page will keep: that statement is about stored backups, and it does not establish whether a live Microsoft 365 environment was affected. A reader who hears that the backups are safe has not been told the mailboxes were untouched. ConnectWise tells partners to keep following the trust-center guidance with their own security teams. This brief will not turn that guidance into a procedure.the security desk.

What disabling the identities does not rewind

The October 18 update says that at 07:00 UTC on October 17 the company disabled seven application identities and suspended the backup service by revoking certificates on the affected connections. Shared credentials for those connections are no longer valid. Disabling them stops new sign-ins through those connections. It does not reverse changes already made inside a tenant. Tokens already issued may work until they expire or are invalidated. Any access created through a different identity, the company says, needs its own review. The identities are ConnectWise's. The tenants belong to the partners' customers.Futureweb.

Huntress and BleepingComputer on the tenant side

Huntress published on October 16 that a ConnectWise Cloud Backup credential was being used to reach customers' Microsoft 365 environments, and that it had high confidence the activity touched management applications for mail, Teams, SharePoint, backup, and the partner center. It says the Graph-token use showed up in Microsoft's sign-in logs starting on or around October 14. BleepingComputer reports a supply-chain path into Microsoft 365 tenants and says administrators had been seeing unauthorized access to client data. Those accounts are why the live-tenant question stays open after ConnectWise's archive sentence. They are not a victim count this page will invent.when one region is the control plane.

A vendor identity is a single hall

Cloud Backup's application identities were trusted inside many tenants because the product's job is to read those tenants' mail and files. One vendor credential, reused across customers, is a hall those customers share even when their own mail servers differ. The suspension is what happens when that hall is no longer trusted. A partner who cannot restore from the archive today is living in that dependency. The trust center says third-party incident response is engaged and that service will return only through a controlled restoration.the paper.

No new finding is a timed statement

At 16:00 UTC on October 18, ConnectWise said it had no new confirmed findings and that it was contacting its partner base about the suspension and the guidance. It promised another update by 19:00 UTC. A status page can be current and still be incomplete. This brief is tied to the 16:00 text. A later update that names affected tenants, or that clears them, replaces the open question about live environments. It does not rewrite the suspension.

What this page will not print

It will not print application identifiers, network addresses, or the click-path a partner would use inside a Microsoft admin center. ConnectWise and Huntress publish those for defenders. A news brief can name the product, the date, the services that stopped, and who is in scope. The in-scope group is partners who used Cloud Backup, formerly SkyKick, and the Microsoft 365 tenants where that application was consented. People who never installed it are outside the sentence.a key the holder checks.

What would close the live-tenant question

A ConnectWise statement that names whether customer tenants were accessed, or a Microsoft statement with the same scope. A restoration notice that says backup jobs run again. Until then the archives are, in the company's words, encrypted and not indicated as compromised, the three services are down, and the other two outlets say tenants were reached through the vendor identity. The short answer this page will stand on is this: ConnectWise's October 18 update says it suspended Cloud Backup, formerly SkyKick, after unauthorized use of application identities, and suspended SaaS Security and Cloud Management with it. Archives are described as encrypted, with no sign of compromise. That does not establish whether live Microsoft 365 tenants were affected.

What stays specific

October 18, 2026, 16:00 UTC. Cloud Backup, SaaS Security, and Cloud Management suspended. Seven application identities disabled at 07:00 UTC on October 17. Archives encrypted, no indication of compromise, live tenants not established by that sentence. Huntress: Graph tokens from about October 14, in its log review. BleepingComputer: tenant access reported by administrators. Guidance stays on the trust center, not on this page. Asked directly, Which services does the October 18 update say are unavailable? Cloud Backup, including jobs, archive access, and restores. SaaS Security monitoring and alerting. Cloud Management user and license management. ConnectWise says those last two were suspended because they are integrated with the backup, out of caution while the investigation continues.