ConnectWise Cloud Backup Issue Investigation

ConnectWise is investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment. Upon detecting this threat, we promptly initiated our incident response procedures. Containment measures are in place, and our investigation continues. At this time, there is no indication that partner backup data has been accessed.

Our engineering teams are continuing to explore the nature and scope of the issue. Our investigation is ongoing, and we will provide additional information as appropriate. We appreciate your patience while we work through this process.

Indicators of Compromise (IOCs)

The following indicators have been associated with the reported suspicious authentication activity .

Source IP Address

144.172.64.128

Observed User Agents

Python-urllib/3.12
python-requests/2.31

These indicators are provided transparency to assist with security monitoring and investigation. Their presence alone does not establish unauthorized activity or confirm compromise.

We recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.

As a protective measure for our Cloud Backup partners and their clients, we are shutting off Cloud Backup application access. This will interrupt backup services for customers until further notice.
We have no indicators to date that Cloud Backup partner backup data has been compromised. The existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored. Our investigation and remediation efforts remain ongoing.

How to Check for Indicators of Compromise (IOCs) :

If you would like to review your environment for potential indicators of compromise associated with this activity, follow the steps below: 

1. In the Microsoft Entra Admin Center, navigate to Monitoring → Sign-in logs, select the Service principal sign-ins tab, and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. 

2. This is where the application's authentication activity is recorded. 

3. The default User sign-ins tab will not display the required information. 

4. In the IP address column, review authentication activity originating from IP addresses outside expected Microsoft/Azure ranges. The application's normal egress has been identified as Azure private IPv6. 

5. Identified suspicious IP address: 144.172.64.128 

The presence of these indicators warrants further investigation but does not, by itself, confirm that your environment has been compromised.

Please check back with our Trust Center for updates and published guidance on monitoring your environment. Coordinate with your security team or managed security provider to review unusual application sign-ins and permission changes. Report suspicious activity to SecurityPartnerSupport@ConnectWise.com.

We recognize the impact on our partners' operations and will provide further updates, including service status through the Trust Center and Partner Care.

Thank you,

ConnectWise

Cloud Backup investigation and service update:

We have taken protective action following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. Our investigation remains ongoing. Since implementing the mitigations described below, we have not observed successful threat activity in the environments we monitor.

Actions taken:

Out of an abundance of caution, we suspended Cloud Backup service by revoking certificates used for affected application connections across all users. This removed ConnectWise’s access through those connections. The shared credentials previously used for Cloud Backup are no longer valid and cannot be used.

In addition to mobilizing our internal security teams and Security Operations Center (SOC), we have engaged a reputable third-party incident response firm to support our investigation and containment efforts. Together, these teams are actively monitoring our backup infrastructure and broader environment, with the investigation extending across all partner-facing services. At this time, we have no indication that any other ConnectWise product, service, or offering is impacted.

Backup data and customer environments:

Cloud Backup archives remain encrypted and isolated. We have no evidence that these encrypted backup archives have been accessed. Existing archives are isolated and preserved, although access and restoration remain unavailable during the service interruption.

These findings relate to our Cloud Backup environment. By design, the configuration of Cloud Backup does not provide us visibility or access to downstream partner and customer environments. As a result, we cannot determine through our investigation alone whether a particular customer’s Microsoft 365 environment experienced unauthorized activity. Partners should continue reviewing their environments with their security teams or managed security providers.

Investigation and restoration:

We are in the second phase of our investigation and response, validating critical findings and mitigation paths. This work will determine the steps required to restore service. We will communicate when we exit this phase and share restoration timing and any required partner actions as soon as possible.

We appreciate the cybersecurity community’s support and contributions to the investigation. We recognize the urgency of restoring protection for our partners and their customers.

We will publish another update later today, October 17, 2026, through the ConnectWise Trust Center, including if there is no material change. Please use the Trust Center for current status and guidance. Contact Partner Care for service assistance and report suspicious activity to SecurityPartnerSupport@ConnectWise.com.

We understand the disruption this incident is causing our partners and their customers, particularly while backup and restoration services remain unavailable. Our teams are working urgently to restore service.

Cloud Backup investigation and service update:

We are continuing our investigation and remediation following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. This update provides more detail on the actions we have taken, the services currently unavailable, and the suggested system checks partners should complete in their Microsoft 365 environments.

Actions taken by ConnectWise:

At 07:00 UTC on October 17, 2026, we disabled the seven ConnectWise application identities posted on our Trust Center page. Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant.

We also suspended Cloud Backup service by revoking certificates used for affected application connections. The affected shared Cloud Backup credentials are no longer valid. Previously issued access tokens may remain usable until they expire or are otherwise invalidated. Any unauthorized credentials, permissions, or other access established through separate identities require additional review and remediation.

In addition to mobilizing our internal security teams and Security Operations Center, we engaged a reputable third-party forensics firm. Together, these teams continue monitoring our backup infrastructure and broader environment. We are also reviewing other potentially affected partner facing services. Since implementing our mitigations, we have not observed successful threat activity in the environments we monitor. Investigation and validation remain ongoing.

We are still in the investigation stage of our incident response process, validating critical findings and mitigation paths. We do not have a restoration time to share yet. We will advise partners when we exit this phase and provide reconnection or reauthorization instructions as soon as they are confirmed.

Service availability and backup data:

Cloud Backup remains suspended. Scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. Existing archives remain encrypted, isolated, and preserved. We have no evidence that these archives have been accessed.

As an additional precaution, we have temporarily taken SaaS Security and Cloud Management offline while we complete our review. During this pause, SaaS Security monitoring and alerting and Cloud Management user and license management are unavailable. Please contact Partner Care for assistance with changes you would normally make through these services.

These service interruptions are proactive, protective actions. They do not, by themselves, establish that a partner or customer environment was compromised. We will communicate service-specific restoration status as our review progresses.


Please visit our Trust Center for important actions to take, technical workflows, and information on our next update.

https://www.connectwise.com/company/trust/advisories