In its October 22, 2026 update, ConnectWise says phased restoration of Cloud Backup, formerly SkyKick, is advancing, with security validation at each step. The company says it will share service-specific availability and reconnection instructions when they are confirmed. Until formal instructions apply to their service, partners should keep affected connections disabled. ConnectWise’s advisory contains the service guidance.
The update follows NeoTeo’s earlier coverage of the Cloud Backup shutdown, which covered the service interruption. The October 22 notice reports progress toward phased restoration.
What the Huntress figures count
Huntress reviewed application sign-ins across more than 10,000 tenants with ConnectWise applications. It reported suspicious activity across more than 1,000 Microsoft tenants and more than 300 sign-ins that appeared successful. Huntress said the observations were incomplete, and some apparent successes occurred in tenants where the application was not present. The 300-plus figure counts sign-ins, not confirmed compromised tenants.
The application identities ConnectWise lists
ConnectWise’s advisory lists seven application identities for review. Their names and client IDs are:
| Application identity | Client ID |
| Cloud Backup | 506e08f9-6e9a-4da4-942b-a099a03644ae |
| Cloud Management | 2399d300-6fca-4e6a-a686-399fefe75b83 |
| Cloud Management - MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 |
| Exchange Online | b78f6a77-d4e5-46fb-87e5-d1648bd02519 |
| MS Graph | 0de14c77-b9b0-4137-9360-34878a929827 |
| Partner Center | 412dcf96-176d-4b3a-a1b0-4981ad66971e |
| SharePoint Online | b2b55f5b-7758-4719-8d8f-88ae172e6bdb |
Disabling an app is only containment
ConnectWise says disabling an affected application connection does not undo changes already made inside a Microsoft 365 tenant. Previously issued tokens could remain usable until they expire or are invalidated.
The company’s guidance calls for reviewing service-principal sign-ins, application credentials and permissions, directory roles, consent, federation trusts, mailbox rules and forwarding, and other identities or policies changed during suspicious activity. These checks address activity inside each tenant, beyond the status of the ConnectWise connection itself.
Separately, ConnectWise said its existing backup archives remained encrypted, isolated and preserved, with no indication of compromise. That statement concerns the archives.