ConnectWise shut down its cloud backup service after unauthorized access, and a security firm says a stolen key is being used to get into Microsoft 365 accounts.
ConnectWise, a software company that supplies tools to IT service providers, has switched off its Cloud Backup service after finding unauthorized access on October 15. As of October 18, the service was still down. Security firm Huntress says a stolen Microsoft 365 key is being used to get into customer accounts. If an IT provider looks after your computers, your backups may be offline.
ConnectWise said it found unauthorized access to application identities inside its Cloud Backup environment. Cloud Backup was formerly known as SkyKick. Two linked services, SaaS Security and Cloud Management, were also suspended as a precaution. ConnectWise has also disabled some links between Cloud Backup and Exchange, Teams, SharePoint Online and its own products.
While the service is down, customers cannot back up data, open their archives or restore files. ConnectWise says existing archives remain encrypted, isolated and preserved, with no evidence of unauthorized access.
Huntress is more blunt. It says a Microsoft 365 secret key belonging to ConnectWise Cloud Backup was compromised and is being used to break into customers' Microsoft 365 environments. In one partner's account, a ConnectWise app gave itself top-level administrator rights. It then added new login credentials to two other apps.
Huntress warns that turning off the abused apps does not remove credentials that were already added. Those need to be found and removed by hand.
The main group is businesses whose IT provider uses ConnectWise Cloud Backup, SaaS Security or Cloud Management, especially on Microsoft 365 or Google Workspace. ConnectWise says the suspension does not mean anyone should assume they were hacked. It means the company is not confident it can run the services safely right now.
Many business owners will not know if this applies to them. IT providers are not required to say which platforms they use. ConnectWise also cannot see inside its partners' customer accounts, so it is relying on those providers to check their own setups.
The alert box above lists the questions to put to your IT provider. The key point is that checking your Microsoft 365 account matters even if the backup app is now off.
ConnectWise has shared few details beyond some technical warning signs tied to a handful of IP addresses and third-party app links. It says it cannot discuss who is behind the attack. It is still running forensic analysis and threat hunting. No restart date for the services has been given.
Attacks on providers like this are a known risk, because one break-in can open a path to many customers. The 2021 attack on Kaseya is the best-known example.
Ask your IT provider whether they use ConnectWise Cloud Backup, and have your Microsoft 365 credentials reviewed even though the apps are switched off.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
