On October 21, ConnectWise said it was continuing its response to unauthorized access to application identities associated with Cloud Backup. The provider disabled the seven identities, reset accounts and credentials in the affected environment, and is preparing a phased restoration. Cloud Backup, SaaS Security and Cloud Management remain suspended while security checks continue.
ConnectWise says the backup archives are encrypted, isolated and preserved, with no indication that they were compromised. That statement does not by itself establish that customer Microsoft 365 tenants experienced no access. The distinction matters: the incident involves identities used by the backup service, while each tenant's local permissions and logs must be reviewed separately.
What ConnectWise has confirmed
The Trust Center advisory links the incident to Cloud Backup application identities. ConnectWise disabled seven applications on October 17, revoked their credentials and completed account and credential resets in the affected environment. As of October 21, it was preparing a phased restoration after security validation.
The suspension has operational consequences: scheduled backups, archive access, restores and several monitoring functions remain unavailable. Customers should check service status and identify their last usable recovery point instead of assuming scheduled jobs are continuing.
What the advisory does not establish
ConnectWise says it has no indication that the encrypted, isolated backup archives were compromised. This describes the provider's current findings about the archives it manages. It does not certify that no customer Microsoft 365 environment was accessed, nor does it establish that files were copied.
Huntress observed sign-in activity from the incident-related address in nearly 1,000 Entra tenants; more than 300 of those sign-ins succeeded. Some still did not grant access because the required application was not present in those tenants. In two tenants it examined in detail, Huntress found privilege changes and credentials added to other applications, but no mailbox or file changes. These findings come from Huntress telemetry, not a global census, and the absence of file changes in those two tenants does not apply automatically to others.
Review your Microsoft 365 tenant
ConnectWise says to keep affected application connections disabled until it provides formal re-enablement instructions. Its guide distinguishes the seven identities disabled in the provider's environment from their state in each tenant: check the local state and disable any connections that remain active, without deleting the applications so evidence is preserved. Review service-principal sign-in logs and preserve available Microsoft Entra and Purview logs. The guide suggests examining activity from October 13 onward and lists 144.172.64.128 as an indicator. An IP match is a signal to investigate, not standalone proof of an incident.
Also check changes to enterprise applications, service principals, credentials, owners and Microsoft Graph permissions. The guide notes that provider-managed secrets and registrations may not be visible to a tenant administrator. Conversely, replacing a legitimate credential does not remove a credential or consent that may have been added locally. Ask your IT lead or service provider to review any unexpected change.
Plan backup continuity
While the service is suspended, ask ConnectWise for the last confirmed backup point for each tenant and the expected restoration timeline. Identify priority Microsoft 365 systems, retention periods and data whose recovery depends on Cloud Backup. Do not re-enable affected applications before the provider's formal instructions. Preserve logs needed for investigation and record missed backup jobs.
Do not reauthorize an application or create a replacement integration based on an unverified email. Use the provider's official channels, confirm the application identifiers it supplies and document requested permissions before granting new consent.
How this relates to Soclyde
This incident is a reminder that integration credentials and application permissions are access credentials too. Soclyde helps teams keep and share business secrets in an encrypted vault available on their devices. That can help teams inventory and hand over documented access in a controlled way.
Soclyde did not prevent this incident, does not control ConnectWise application identities and does not review Microsoft 365 logs. Revocation and permission checks must happen in the consoles of the affected services.
Key takeaway
Focus on two tasks: follow the official service restoration updates and review your own tenant's logs and permissions. Public information does not confirm widespread exfiltration of customer data. To organize business credentials alongside these checks, read our guide to securing passwords.
