Eigen RadarAI
Archive
Analysis

ConnectWise pauses more cloud services as token review continues

ConnectWise has kept Cloud Backup suspended and temporarily taken SaaS Security and Cloud Management offline as a precaution. The company says affected shared credentials are invalid, while previously issued access tokens may remain usable until expiry or invalidation. Backup archives remain encrypted and preserved, but restoration is unavailable. Customers’ live Microsoft 365 environments require their own investigation.

Artificial Intelligence··Morning
Intact unmarked storage equipment behind a closed mesh cabinet in a bright equipment room.

Backup remains paused as two more services go offline

ConnectWise, the provider of Cloud Backup formerly known as SkyKick, suspended customer access after unauthorized access to application identities. It announced the interruption on October 17 and subsequently revoked certificates for affected connections across all users. Existing archives remain encrypted, isolated and preserved, according to the company, which reports no evidence that those archives were accessed. Access to archives and restoration remain unavailable during the interruption.[1], [2]

The October 18 update also places SaaS Security and Cloud Management offline as a precaution. Monitoring and alerts in SaaS Security and user and license management in Cloud Management are unavailable. These protective service interruptions do not establish that a customer environment was compromised.[1]

Invalidated credentials leave separate access paths to review

ConnectWise says the affected shared credentials are no longer valid. Previously issued access tokens, which authorize requests, may nevertheless remain usable until they expire or are invalidated. Unauthorized credentials or permissions established through separate identities require additional investigation and remediation. Disabling the original connections does not undo changes already made inside a customer environment.[1]

Customer investigation extends across sign-in categories

Partners are asked to examine their own Microsoft 365 environments and those they manage. The latest guidance covers interactive and non-interactive user sign-ins, service-principal sign-ins and managed identities. Expected Microsoft or private addresses do not establish authorization. A successful sign-in alone does not establish data copying, while a clean search cannot exclude unlogged activity. ConnectWise has engaged outside incident responders and has not announced a restoration time.[1]

References

  1. News sourceConnectWiseConnectWise suspends Cloud Backup connections and revokes certificates↩1↩2↩3↩4
  2. News sourceBleepingComputerConnectWise shuts Cloud Backup access after unauthorized application access↩
AI safety and regulation

More analysis from this desk

View all Brief analyses from the Artificial Intelligence desk →