TL;DR: ConnectWise has suspended Cloud Backup, formerly known as SkyKick, after what it calls “unauthorized access to application identities associated with ConnectWise Cloud Backup.” That stopped scheduled backups and restores, and ConnectWise also took SaaS Security and Cloud Management offline as a precaution. It says it has finished resetting accounts and credentials and, as of Oct 21 at 12:45 UTC, has begun restoring services in controlled phases, which it expects to take several days; it says the start of restoration “does not mean all capabilities are available.” On Oct 22 at 00:45 UTC, ConnectWise said “Phased restoration is underway” and still expects restoration “to take several days.” Its Oct 23 updates, at 01:00 and 14:00 UTC, say it expects to finish validating the restored environment this weekend and, if that succeeds, to let partners restore from existing backups “early next week”; until then, keep affected app connections disabled. If you, or your IT provider, use these services with Microsoft 365, review your tenant now.

What happened

ConnectWise first published its advisory on Oct 16 at 17:47 UTC (Oct 17, 1:47 a.m. Manila time) and has updated it several times since. The latest update we checked was posted Oct 23 at 14:00 UTC (10:00 p.m. Manila). ConnectWise now says it “will publish updates once daily at 14:00 UTC, with significant developments shared sooner.”

ConnectWise says it is investigating “unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick.” Those application identities are the apps the service uses to connect to Microsoft 365.

Microsoft Threat Intelligence posted on Oct 17 at 07:29 UTC (3:29 p.m. Manila) that it “is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens.”

According to ConnectWise:

  • At 07:00 UTC on Oct 17 (3:00 p.m. Manila), it disabled seven ConnectWise application identities. It says this “prevents new authentication through those connections; it does not reverse changes previously made inside a tenant.”
  • It revoked the certificates for the affected connections. “Previously issued access tokens may remain usable until they expire or are otherwise invalidated.”
  • Existing backup archives “remain encrypted, isolated, and preserved. We have no evidence that these archives have been accessed.”
  • It can’t see into customer tenants: Cloud Backup “does not provide the downstream security visibility needed for us to determine independently whether a particular partner or customer tenant experienced unauthorized activity.”
  • It says the service shutdowns “do not, by themselves, establish that a partner or customer environment was compromised.”
  • On Oct 19 it said: “Since implementing mitigations, we have not observed successful threat activity in the environments we monitor since October 17, 05:00 UTC” (Oct 17, 1 p.m. Manila). Cloud Backup, SaaS Security and Cloud Management remain suspended, with no confirmed restoration time. “Scheduled backups, archive access, and restores remain unavailable.”
  • In its Oct 19, 18:50 UTC update, it added: “We are monitoring our entire environment, with no indication of impact beyond Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management.” All three services are still suspended.
  • In its Oct 20, 00:45 UTC update, it said it is “resetting accounts and replacing application credentials within that environment” and plans “to restore services in controlled phases, subject to completion of the required remediation and security validation.” Cloud Backup, SaaS Security and Cloud Management “remain suspended,” and ConnectWise says it will give partners instructions before services are re-enabled.
  • In its Oct 20, 12:45 UTC update, it said its teams “continue advancing remediation, resetting accounts, replacing application credentials, and validating the affected environment for safe restoration.” It still plans “a controlled, phased restoration following required remediation and security validation, with partner instructions provided before re-enablement,” and says “Cloud Backup jobs, archive access, and restores remain unavailable.” SaaS Security and Cloud Management remain suspended, and there is still no restoration time.
  • Update, Oct 21, 2026, 8:00 a.m. Manila: In its Oct 20, 19:00 UTC update (Oct 21, 3:00 a.m. Manila), ConnectWise said: “We have completed an account and credential reset in the affected Cloud Backup environment and are preparing for phased service restoration.” It says that full reset was done on Oct 19, and that it is “completing security validation before moving to the next phase.” It will restore “core infrastructure first, with additional review of the most sensitive connections.” ConnectWise adds: “Once restoration begins, we expect the process to take several days. We will share a more reliable timeline after the first full day of restoration work and provide instructions before partners need to re-enable connections.” Restoration hasn’t started yet: Cloud Backup, SaaS Security and Cloud Management “remain suspended,” and backups, archive access, restores, SaaS Security monitoring and alerting, and Cloud Management user and license management are still unavailable. ConnectWise still tells partners to keep the affected Cloud Backup app connections disabled until it sends formal re-enablement instructions. For planning, that means at least several more days without these services: if you rely on Cloud Backup for Microsoft 365, arrange another backup for the meantime.
  • Update, Oct 21, 2026, 9:30 a.m. Manila: In its Oct 21, 00:30 UTC update (8:30 a.m. Manila), ConnectWise said it continues “advancing remediation and security validation as we prepare for phased service restoration,” and that “Previously published findings and partner guidance remain current.” Cloud Backup, SaaS Security and Cloud Management “remain suspended,” and there is still no restoration date: ConnectWise says it “will share restoration timing and any required reconnection instructions as soon as confirmed.” Its partner webinars continue “every two hours.”
  • Update, Oct 21, 2026, 9:12 p.m. Manila: In its Oct 21, 12:45 UTC update (8:45 p.m. Manila), ConnectWise said: “We have begun restoring services in controlled phases, following remediation and security validation.” It says: “We expect restoration to take several days. Service availability will return in stages, and the start of restoration does not mean all capabilities are available.” The update doesn’t say which services, if any, are available again. ConnectWise says it will publish step-by-step instructions on when and how partners should reconnect affected services, “including any required reauthorization and verification steps,” and until then: “Keep affected application connections disabled until ConnectWise provides formal instructions for your service.” It says existing backup archives “remain encrypted, isolated, and preserved, with no indication of compromise,” but that these findings “do not establish whether individual partner or customer Microsoft 365 environments were affected.” Its next update is due by Oct 21 at 19:00 UTC (Oct 22, 3:00 a.m. Manila).
  • Update, Oct 22, 2026, 9:26 a.m. Manila: ConnectWise posted three more updates. At 19:00 UTC on Oct 21 (3:00 a.m. Manila), it said restoration in controlled phases continues and “the start of restoration does not mean all capabilities are available”; it will share “service-specific availability and step-by-step reconnection instructions as they are confirmed,” and partners should still “Keep affected application connections disabled until formal instructions apply to your service.” It also published a list of its own public IPv4 and IPv6 addresses for reference. In its 22:00 UTC update (6:00 a.m. Manila), ConnectWise says that, based on the evidence available to it, including threat intelligence shared by Microsoft, “it appears that a China state-aligned group was responsible for the attack,” and that the group “used an openly available agentic AI framework to automate and speed up its operation.” In its own report, Microsoft says it “assesses that Storm-0940 was responsible” and that the group used the framework ARTEX for attempted sign-ins to more than 2,250 tenants; see our story on what Microsoft found and what to check. ConnectWise says it has contained the affected application connections and is restoring services in controlled phases, but that those actions do “not remove unauthorized access that may already have been established within individual customer tenants, which require separate review.” It again tells partners to keep affected connections disabled until it issues formal instructions. In its Oct 22, 00:45 UTC update (8:45 a.m. Manila), ConnectWise says “Phased restoration is underway, with each step subject to security validation,” that it expects restoration “to take several days,” and that it will share “service-specific availability and reconnection instructions as confirmed”; until then, “Keep affected connections disabled until formal instructions apply to your service.” It says existing backup archives “remain encrypted, isolated, and preserved, with no indication of compromise,” and that it has “no indication that other ConnectWise products, services, or offerings are impacted by this incident,” but “Individual Microsoft 365 tenants still require review for unauthorized changes or persistent access.” It says that beginning October 22 it will publish updates twice daily.
  • Update, Oct 22, 2026, 10:20 p.m. Manila: In its Oct 22, 13:00 UTC update (9:00 p.m. Manila), ConnectWise says its teams “continue advancing phased restoration, completing the security validation required at each step,” and that it will share “service-specific availability and reconnection instructions as they are confirmed.” It again says to “Keep affected connections disabled until formal instructions apply to your service,” that backup archives remain “encrypted, isolated and preserved, with no indication of compromise,” and that “Reviewing individual Microsoft 365 environments remains essential.” It reports no services back yet and says its next update will be published “by October 23 at 01:00 UTC” (9:00 a.m. Manila).
  • Update, Oct 23, 2026, 10:40 a.m. Manila: In its Oct 23, 01:00 UTC update (9:00 a.m. Manila), ConnectWise says it expects to finish testing and security validation of the restored environment “by the end of this weekend” and anticipates backup restoration access “early next week,” followed by phased re-enrollment with instructions, videos and webinars. It says to “keep affected application connections disabled until ConnectWise provides instructions that apply to your service,” that archives “remain encrypted, isolated and preserved, with no indication of compromise,” and that it is moving to once-daily updates.
  • Update, Oct 24, 2026, 7:35 a.m. Manila: In its Oct 23, 14:00 UTC update (10:00 p.m. Manila), ConnectWise keeps the same timeline. It says its teams “and independent specialists continue restoration testing and security validation,” which it expects to finish “by the end of this weekend.” It anticipates “enabling a process for partners to restore data from existing backups early next week, following successful testing and validation,” with phased re-enrollment after that. The guidance hasn’t changed: keep affected application connections disabled until ConnectWise sends instructions for your service, and keep reviewing your Microsoft 365 environments. ConnectWise says archives “remain encrypted, isolated and preserved, with no indication of compromise.” Updates now come once a day at 14:00 UTC (10:00 p.m. Manila), and the next is due “by October 24 at 14:00 UTC.” Plan on Cloud Backup restores being unavailable until at least early next week.

Who’s affected

These are cloud services, so there are no version numbers to check. ConnectWise names:

  • ConnectWise Cloud Backup (formerly SkyKick): suspended. Scheduled backups, access to affected archives and restores were unavailable. ConnectWise says it began restoring services in phases as of Oct 21, 12:45 UTC, but hasn’t said which capabilities are back.
  • SaaS Security and Cloud Management: taken offline as a precaution. Monitoring and alerting, and user and license management, were unavailable, and ConnectWise hasn’t said whether they are back. ConnectWise says to contact Partner Care for changes you’d normally make there.

The seven application identities ConnectWise disabled are ConnectWise Cloud Backup and ConnectWise Cloud Management, plus Cloud Management apps for MS Teams, Exchange Online, MS Graph, Partner Center and SharePoint Online. The advisory lists each Application ID. Older installations may show SkyKick Cloud Manager names, so ConnectWise says to match on Application ID, not display name.

ConnectWise says partners should review their own Microsoft 365 tenant and each customer tenant they manage, “including environments with dormant SkyKick connections.”

What SMBs and MSPs should do now

If you’re an SMB: ask your IT provider whether they use ConnectWise Cloud Backup, SkyKick, SaaS Security or Cloud Management for your Microsoft 365, and whether they’ve reviewed your tenant. ConnectWise says restoring these services will take several days and hasn’t said which capabilities are back, so ask what covers your backups in the meantime.

If you’re an MSP or Microsoft 365 admin, ConnectWise now points partners to its official Cloud Backup technical investigation and remediation guide (PDF). On Oct 19 it said: “Review your own Microsoft 365 tenant and each customer tenant you manage, and keep affected applications disabled pending formal restoration instructions.” ConnectWise has also posted a step-by-step video walkthrough of selected steps from the guide on its Trust Center, with this warning: “Completing these steps does not guarantee that a tenant is unaffected or that all unauthorized access has been eliminated.” It also asks resellers, distributors and marketplace partners to pass the guidance to the administrators responsible for each customer. On Oct 20 it said it is running technical webinars for partners “every two hours beginning today, October 20, at 18:00 UTC” (Oct 21, 2:00 a.m. Manila), covering “Microsoft Entra ID sign-in and audit logs, application registrations, credentials, and permissions.” ConnectWise’s advisory asks you to:

  1. Check the apps. In Microsoft Entra, find each listed Application ID under Enterprise applications and keep them disabled until ConnectWise gives restoration instructions. Don’t delete them first; ConnectWise says to preserve the configuration as evidence.
  2. Save the logs now. Export audit and sign-in records promptly. ConnectWise notes Entra normally keeps them for seven days on Free and 30 days on P1/P2, and “a license upgrade does not recover expired history.”
  3. Review sign-ins. Look from Oct 13, 2026 to now, and back to Oct 1 where records exist. Filter for the addresses ConnectWise has published, 144.172.64.128, 144.172.64.99 and 144.172.64.60 (the last two added on Oct 18 at 18:45 UTC, or Oct 19, 2:45 a.m. Manila), and for each listed Application ID, but don’t search only those addresses: ConnectWise says to review any unfamiliar addresses too.
  4. Review access and changes. Check application credentials and federation trusts, directory roles, owners, consent grants and recent policy changes.
  5. Check mail. Look for “unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access.”
  6. Follow other identities. Disabling the original apps “does not remove those separate access paths,” so investigate any other identity changed or used during suspicious activity.

ConnectWise says a successful sign-in alone doesn’t prove data was copied, and a clean search can’t rule out activity that wasn’t logged. Report suspicious activity to ConnectWise’s security partner support address listed in its advisory. ConnectWise says it will keep updating its Trust Center, which is the place to check for restoration status.

Sources & method

Sources

Method. Last checked October 24, 2026, at 7:00 a.m. Manila time (October 23, 23:00 UTC). Every claim comes from ConnectWise’s advisory or Microsoft Threat Intelligence’s posts. Microsoft revised its October 21 blog post on October 22 without an editor’s note (the page now lists a modified time of 23:15 UTC on October 22, 7:15 a.m. Manila on October 23; the text we cite is unchanged); we cite the current version. The only tenant count we cite is Microsoft’s; we did not use third-party counts. Manila times are converted from the UTC times in the sources. The advice to arrange another backup in the meantime, and to plan on restores being unavailable until at least early next week, is our own judgment. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.