ConnectWise suspends Cloud Backup and related services after unauthorized access

ConnectWise detected unauthorized access to application identities in its Cloud Backup (formerly SkyKick) environment on October 15 and suspended Cloud Backup, SaaS Security and Cloud Management. Huntress says a compromised M365 API secret was used to access customer tenants; the services remained offline as of October 18.

• ConnectWise Cloud Backup, SaaS Security and Cloud Management have been down since October 15
• Huntress: a stolen M365 API secret was used to access MSP customer environments
• In one tenant a ConnectWise app granted itself Global Administrator rights
• Archives remain encrypted with no evidence of unauthorized access