Skip to content
Zensec is aware of an ongoing security incident affecting ConnectWise Cloud Backup, formerly known as SkyKick.
ConnectWise has reported unauthorised access to application identities associated with its Cloud Backup service. In response, Cloud Backup has been suspended while investigation and remediation work continues. SaaS Security and Cloud Management have also been temporarily suspended as a precaution.
ConnectWise has implemented containment measures and is working with third-party incident response specialists. In its latest update, it stated that it has not observed successful threat activity in the environments it monitors since these mitigations were implemented.
Existing backup archives remain encrypted and isolated, and ConnectWise says it has no evidence that these archives have been accessed. However, the investigation remains ongoing, and partners have been advised to review their own Microsoft 365 environments and any managed customer tenants in line with the published technical guidance.
What should organisations do?
ConnectWise has issued technical investigation and remediation guidance for partners and customer administrators. This includes reviewing affected application connections, authentication and audit activity, credentials and permissions, directory roles and recent policy changes, as well as checking for unauthorised mailbox forwarding, rules or delegated mailbox access.
Affected applications should remain disabled pending formal restoration instructions from ConnectWise.
Zensec is monitoring the situation and will keep this advisory updated as further confirmed information becomes available. Organisations using affected ConnectWise services should continue to follow the latest guidance from ConnectWise.
Update: 20 October 2026
ConnectWise has confirmed that containment measures remain in place and that it has observed no successful threat activity in monitored environments since mitigations were implemented on 17 October. It has also stated that there is currently no indication of impact beyond Cloud Backup and the precautionary suspension of SaaS Security and Cloud Management.
All three services remain suspended while investigation, remediation and security validation continue. Organisations have been advised to keep affected applications disabled and continue following ConnectWise’s technical investigation and remediation guidance pending formal restoration instructions.
Update – 26 October 2026
ConnectWise has issued a further update on the Cloud Backup security incident. The company says its teams and independent specialists are continuing restoration, testing and security validation following the discovery of unauthorised access to application credentials associated with Cloud Backup, formerly SkyKick.
ConnectWise has previously confirmed that affected application connections were disabled and that account resets and application credential replacement formed part of its remediation activity. Organisations potentially affected should continue to review their Microsoft 365 environments rather than assume that stored backup data being preserved means their live tenant was unaffected.
View the latest ConnectWise security advisory and technical guidance
