In its October 22, 2026 update, ConnectWise says phased restoration of Cloud Backup, formerly SkyKick, is advancing, with security validation at each step. The company says it will share service-specific availability and reconnection instructions when they are confirmed. Until formal instructions apply to their service, partners should keep affected connections disabled. ConnectWise’s advisory contains the service guidance.

The update follows NeoTeo’s earlier coverage of the Cloud Backup shutdown, which covered the service interruption. The October 22 notice reports progress toward phased restoration.

What the Huntress figures count

Huntress reviewed application sign-ins across more than 10,000 tenants with ConnectWise applications. It reported suspicious activity across more than 1,000 Microsoft tenants and more than 300 sign-ins that appeared successful. Huntress said the observations were incomplete, and some apparent successes occurred in tenants where the application was not present. The 300-plus figure counts sign-ins, not confirmed compromised tenants.

The application identities ConnectWise lists

ConnectWise’s advisory lists seven application identities for review. Their names and client IDs are:

Application identityClient ID
Cloud Backup506e08f9-6e9a-4da4-942b-a099a03644ae
Cloud Management2399d300-6fca-4e6a-a686-399fefe75b83
Cloud Management - MS Teams24205314-2b89-4e07-a2a4-579e898a5640
Exchange Onlineb78f6a77-d4e5-46fb-87e5-d1648bd02519
MS Graph0de14c77-b9b0-4137-9360-34878a929827
Partner Center412dcf96-176d-4b3a-a1b0-4981ad66971e
SharePoint Onlineb2b55f5b-7758-4719-8d8f-88ae172e6bdb

Disabling an app is only containment

ConnectWise says disabling an affected application connection does not undo changes already made inside a Microsoft 365 tenant. Previously issued tokens could remain usable until they expire or are invalidated.

The company’s guidance calls for reviewing service-principal sign-ins, application credentials and permissions, directory roles, consent, federation trusts, mailbox rules and forwarding, and other identities or policies changed during suspicious activity. These checks address activity inside each tenant, beyond the status of the ConnectWise connection itself.

Separately, ConnectWise said its existing backup archives remained encrypted, isolated and preserved, with no indication of compromise. That statement concerns the archives.