In its 13:45 UTC update on October 19, 2026, ConnectWise said Cloud Backup, SaaS Security, and Cloud Management were suspended. Scheduled backups, archive access and restores, SaaS Security monitoring and alerts, and Cloud Management user and license management were unavailable. The update gave no confirmed restoration time. ConnectWise’s advisory
What the archive statement covers
ConnectWise said its stored backup archives remained encrypted and isolated, with no evidence that those archives had been accessed. That statement concerns hosted backups. ConnectWise also said it could not independently determine whether an individual customer’s live Microsoft 365 tenant had unauthorized activity.
Huntress and Todyl reported that a compromised vendor credential was used to authenticate as the Cloud Backup application in Microsoft 365 tenants. This app-only sign-in uses an application identity rather than an interactive user account. Todyl said the application used permissions previously granted in the tenants, and that user-focused multifactor authentication did not apply to the observed app-only token flow. Those permissions included access to mail and attachments, OneDrive and SharePoint files, and Teams chats; they describe what the application could access, not what attackers necessarily read. Huntress’s investigation and Todyl’s investigation
Todyl also reported that missing Microsoft Graph activity logs prevented it from distinguishing some reads from normal backup activity. In tenants where the application served both purposes, the same identity appeared in both kinds of activity.
What ConnectWise told partners to review
ConnectWise advised partners to preserve available logs, keep affected applications disabled, and review sign-ins, credentials, permissions, role assignments, mailbox changes, and other identity changes in their own and managed customer tenants. It said to wait for formal restoration or reconnection instructions. ConnectWise also said disabling the seven affected application identities on October 17 prevented new authentication through those connections but did not reverse changes already made in a tenant; previously issued tokens could remain usable until they expired or were invalidated. The advisory includes ConnectWise’s partner guidance.
Huntress reported unauthorized sign-ins using the original vendor credential in 173 partner and customer tenants. Separately, it reported sign-in activity from the associated IP address in nearly 1,000 Entra tenants and more than 300 successful sign-ins. Those broader IP-activity figures measure something different from the 173 reported tenants. Huntress’s later incident update and its analysis of the broader activity.
NeoTeo previously covered ConnectWise’s certificate revocation and credential invalidation in its earlier report.
