ConnectWise Suspends Cloud Backup After M365 Credential Theft - Why MSP Supply Chains Matter to Every UK Business

ConnectWise, which supplies management and backup tools to managed service providers, has suspended its Cloud Backup, SaaS Security and Cloud Management services after identifying unauthorised access to application identities in its Cloud Backup environment on 15 October 2026. As of 16:00 UTC on 18 October, the services remained unavailable — meaning end users could not back up data, access archives or restore. ConnectWise says existing archives “remain encrypted, isolated, and preserved, with no evidence of unauthorized access”. Security firm Huntress gives a starker account: it says a Microsoft 365 credential belonging to ConnectWise Cloud Backup has been compromised and that it has confirmed it is being used to gain unauthorised access to customers’ Microsoft 365 environments.

The two accounts are not necessarily contradictory — one speaks to stored backup archives, the other to access into live Microsoft 365 tenants — but together they describe a serious situation still being worked through. For UK businesses, the most important detail is structural rather than technical. ConnectWise sells to MSPs, who use its tools to support their own customers. Because MSPs are under no obligation to disclose which platforms underpin their services, many small businesses affected by this will not know that ConnectWise plays any part in their IT at all. That is the same shape as the 2021 Kaseya ransomware attack, in which a single vulnerable MSP software platform led to roughly 1,500 downstream businesses being compromised. If you rely on an IT provider, the platforms it uses are part of your attack surface whether or not you know their names — and this week is a good moment to ask.

What ConnectWise and Huntress have each said

ConnectWise provides ERP and management tools to MSPs, including Cloud Backup, formerly known as SkyKick. Its advisory says that on 15 October 2026 it identified unauthorised access to application identities within its Cloud Backup environment, and that it initiated a “service interruption” suspending Cloud Backup along with SaaS Security and Cloud Management, because those two are integrated with it. Its VP of security operations, Jason Ferguson, said existing archives remain encrypted, isolated and preserved with no evidence of unauthorised access, and that the suspension does not mean customer environments should be assumed compromised — only that ConnectWise is not confident it can operate the services safely.

ConnectWise has said it “cannot discuss threat actor attribution at this time”, and has called on customers to proactively check their own Microsoft 365 environments for signs of compromise. It has also pointed out a structural limit: by design, it has no visibility into how individual MSPs have configured their end customers’ systems. That is a fair statement of how the MSP model works, and it means the checking has to happen at the MSP and customer level.

Huntress’s assessment is more direct. It says: “A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers’ M365 environments.” It describes one partner tenant in which a second ConnectWise application was used to grant itself Global Administrator privileges and then added new credentials to two other applications in that tenant — including a Huntress application unique to that partner.

Huntress’s most practical warning concerns cleanup. It says that “disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added”, and that affected organisations must review the credentials on all their Microsoft 365 applications, not only disable the compromised one. That is the detail most likely to be missed in a rushed response: an attacker with administrative control may have planted access elsewhere in the tenant, and turning off the original entry point does not remove it.

The two positions address different questions. ConnectWise’s statement about archives concerns the backup data it holds. Huntress’s concerns access into customers’ live Microsoft 365 tenants using a compromised application credential. A business should take both seriously: its backups may well be intact, and its tenant may still need checking.

How the incident has unfolded

The chronology below follows what ConnectWise and Huntress have published, with the Kaseya precedent for context. The situation was still developing at the time of the last reported update.

The duration of the outage is a lesson in itself. For several days, organisations whose Microsoft 365 backup ran through this platform could not back up new data, could not reach their archives and could not restore. If an incident such as accidental deletion, ransomware or a malicious change had occurred in that window, the usual safety net would not have been available. That is not a reason to avoid third–party backup — it is a reason to make sure a backup service is not the only copy, and that recovery does not depend on a single platform being online.

What limits the damage from a compromised third–party app

The chart below is an indicative planning model — not measured data — ranking measures by how much they limit harm when a third–party application connected to a Microsoft 365 tenant is compromised.

The bottom bar reflects Huntress’s warning directly. Disabling the compromised app feels decisive and is necessary, but on its own it may leave credentials the attacker planted in other applications untouched. The second bar is the step that addresses that: a systematic review of every application’s credentials, looking for anything added recently or unexpectedly.

The top bar is about recovery rather than containment. During this incident, end users of the affected services could not restore. An organisation with an additional, independent copy of its critical Microsoft 365 data — held under separate credentials and not dependent on the same platform — would still have had a way to recover if something had gone wrong in that window. The principle is the same one that applies to any backup: a copy is only a safety net if it does not share a failure with the thing it protects.

Back up, access archives, restore — none available

Take the three things an end user normally relies on a backup service to do, and check them against the outage.

ConnectWise’s position is that the archives are safe, and there is no reason to doubt that the data itself is preserved. But data that is safe and data that is available are not the same thing. For the duration of the suspension, organisations depending on these services had a backup they could not use. Most of the time, that is an inconvenience. If it coincides with the moment you need a restore — a deleted mailbox, a ransomware incident, a malicious change by an attacker who has gained access to the tenant — it is a serious problem.

This is a reminder that backup resilience has two dimensions. The first is whether the data survives, which is what most backup decisions focus on. The second is whether you can get it back when you need it, which depends on the backup platform being available and on the credentials and tools needed to reach it being intact. A single backup provider, however good, is a single point of failure for that second dimension.

For the many small businesses whose Microsoft 365 backup is arranged by an IT provider, it is worth knowing what the arrangement actually is. Which platform holds your backups? Is there more than one copy? If that platform were offline for a week, how would you restore a deleted mailbox? Those are reasonable questions for any customer to ask, and a good provider will welcome them.

Where UK businesses are exposed

The rows below reflect where supply–chain and Microsoft 365 application risk typically sits for a UK SME, particularly one that relies on an MSP, with badges indicating how much attention each usually needs.

The first row is the heart of the supply–chain problem, and it is not a criticism of MSPs. Using specialist platforms to manage many customers efficiently is how the MSP model works, and it usually delivers better results than each small business trying to do everything itself. But it means the customer’s security depends on platforms it has never heard of. Asking your provider which platforms have access to your environment — and what happens if one of them has an incident — is a normal part of supplier oversight, not an accusation.

The seventh row is the practical consequence. In an incident like this, the first an end customer may hear of it is from the news, if at all. Agreeing in advance how your IT provider will tell you about incidents at the platforms it uses — and what it will do about them — means you are not left wondering whether a headline affects you. It also gives you a basis for the conversation when something does happen.

What reducing this exposure costs

The bands below are indicative planning figures for UK businesses reviewing their Microsoft 365 application security and backup resilience — not quotes.

The first row is free and is the right starting point for any business that relies on an IT provider. A short message asking whether ConnectWise’s affected services are used in your environment, and what has been done about it, is entirely reasonable this week. Most providers will already be working through it and will be glad to explain where things stand.

Two ways to rely on an IT provider

None of the right–hand column requires abandoning an MSP or a third–party backup service. Both remain sensible choices for most small businesses. The difference is visibility and redundancy: knowing what has access to your environment, limiting what it can do, and ensuring that one platform’s bad week does not leave you without a way to recover. Those are reasonable expectations to set with any IT provider, and reasonable questions for any provider to answer.

Why MSP supply chains matter to every small business

The MSP model is one of the most useful developments in small–business IT. It gives organisations without in–house expertise access to specialist tools, monitoring and support at a cost they can afford. It also concentrates risk. A single platform used by many MSPs, each serving many customers, becomes a route to a very large number of businesses at once. Kaseya demonstrated that in 2021, with roughly 1,500 downstream businesses compromised. The ConnectWise incident is a reminder that the same structure still exists.

The visibility problem is the part small businesses can do something about. MSPs are not obliged to disclose which platforms underpin their services, and in normal times there is little reason for customers to ask. But when an incident like this happens, the customers who know which platforms their provider uses can quickly establish whether they are affected; those who do not are left waiting. A short, current list of the key platforms with access to your environment — for monitoring, remote management, backup and security — is a sensible thing to hold, and a reasonable thing to ask a provider for.

The Microsoft 365 dimension adds a specific lesson about third–party applications. Backup, security and management tools connect to a tenant through application identities with permissions to read and sometimes change data. Those identities are powerful, rarely reviewed, and, as Huntress describes, can be used to create further access if compromised. Treating them like any other privileged account — with least privilege, approval for new ones, monitoring for changes and periodic review — is good practice regardless of this incident.

For organisations pursuing Cyber Essentials, these application identities and the platforms your provider uses are worth raising during scoping. The scheme’s user access control requirements are built around knowing which accounts exist, what privileges they hold and removing those that are not needed. Third–party apps with administrative rights in your tenant are privileged accounts in every meaningful sense, and they belong in that conversation.

The story at a glance

This story connects to several we have covered recently. The JadePuffer attackers hijacking Azure service principals is the closest technical parallel: machine identities with powerful permissions, compromised and used to reach further. The Met Police shadow IT reprimand is about not knowing which third–party platforms hold your data — the same visibility gap, from a different direction. The CMA’s proposed designation of Microsoft examines dependency on a single supplier’s ecosystem. Our piece on building–system ransomware describes contractor remote access as a common, overlooked route in. The Cisco email gateway zero–day is another case of a security tool becoming part of the attack surface. And Microsoft’s OneDrive storage changes made the point that sync is not a backup — and this incident adds that one backup is not always enough.

Frequently asked questions

Cloudswitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.