A business can protect its staff accounts and still face risk through a service connected to its cloud environment. The ConnectWise Cloud Backup incident shows why those connections need attention too.
ConnectWise is investigating unauthorised access involving application identities associated with Cloud Backup, formerly SkyKick. Its Trust Center advisory says Cloud Backup and the related SaaS Security and Cloud Management services have been suspended while investigation and remediation continue.
For customers, the immediate task is to establish whether they use the affected services and who is responsible for reviewing their environment.
What Is Known About The Incident
ConnectWise says existing backup archives are encrypted, isolated and preserved, with no evidence those archives were accessed. During the suspension, scheduled backups, archive access and restores are unavailable.
Those statements describe different issues. Preserved archives do not mean a business can restore from them during the interruption, and a statement about backup archives does not establish the condition of every connected Microsoft 365 environment.
The vendor directs partners and customer administrators to review their own environments using its investigation and remediation guidance. The investigation remained ongoing when this article was prepared on 20 October.
Why A Connected Application Can Matter
A backup service needs permission to perform its work. Those permissions create a relationship between the external service and the customer’s environment, separate from an employee signing in to email.
In its 19 October analysis, CoreView explains why disabling the affected applications does not undo changes an attacker may already have made. Its analysis discusses reviewing role assignments, credentials, mailbox settings and other configuration changes.
That is a reason for a structured investigation. It is not proof that every organisation using the service experienced all of those changes.
What Business Owners Should Ask Their IT Provider
Start with a direct question: do we use ConnectWise Cloud Backup, former SkyKick services or the affected related integrations? The answer may sit with a managed IT provider rather than the person paying the Microsoft invoice.
If the answer is yes, ask whether your environment has been reviewed against the current vendor guidance, what evidence was checked and whether any findings require further action. Request a written update in language your business can understand.
Then ask about operational continuity. When did the last successful backup complete? Which restoration options are currently available? How will important work created during the interruption be protected?
Why Restoring Service Is Only One Milestone
Getting a backup product running again and confirming a customer’s environment is clean are separate pieces of work. A clear recovery update should address both.
Avoid making uncoordinated changes to business cloud permissions based on a news article. The administrator responsible for your systems should preserve relevant evidence, investigate findings and follow current remediation instructions.
For a small business, the most useful outcome is a specific answer about its own exposure and recovery arrangements. “We use Microsoft 365” is too broad to establish whether this incident affects you; the connected services and their permissions are what need checking.