ConnectWise pauses SaaS backup, security services amid incident probe

Key points

• ConnectWise took unspecified services offline on Oct. 19, 2026.
• SaaS backup and security management offerings were affected.
• Huntress alleges Microsoft 365 accounts were compromised.
• Customer count and data impact are not disclosed.

On October 19, 2026, ConnectWise removed part of its service lineup from availability while it began examining a security event. The company has not said how many customers, tenants, or records are involved. The affected area includes SaaS backup and security management offerings, based on the facts released so far.

Huntress has publicly claimed that Microsoft 365 accounts were taken over. ConnectWise and Microsoft are the vendors tied to the situation. No CVE has been assigned, and the allegation has not been paired with a public count of compromised identities. That absence of scope is important: it leaves district teams unable to judge exposure from the outside.

For K-12 IT staff, the two threads create separate risks. A pause in backup or security tooling can leave Microsoft 365 mailboxes, files, and configuration data without expected protection or monitoring. A takeover claim, meanwhile, points to identity controls: sign-in activity, multifactor authentication, session tokens, and mailbox rules. The facts do not establish that the two issues are directly linked, so treat them as related concerns to verify rather than proven cause and effect.

Vendor incidents often become customer incidents through shared dependencies. Watch for a ConnectWise restoration timeline, customer notices, Huntress technical detail such as indicators or affected tenant patterns, and any Microsoft confirmation. Until then, avoid assuming scale. Check your own logs, confirm which services you rely on, and preserve evidence.

What to do now

1. Confirm whether your district uses the affected ConnectWise SaaS backup or security management offerings, record current service status, and open a vendor ticket for updates.
2. Review Microsoft 365 sign-in and audit logs around Oct. 19, 2026 for unfamiliar IPs, impossible travel, MFA changes, new mailbox rules, or unusual OAuth grants.
3. Revoke active sessions and reset credentials for any suspicious Microsoft 365 accounts, then enforce MFA and conditional access policies.
4. Validate backup integrity and run a restore test for Microsoft 365 data; document any gaps caused by the service pause.
5. Rotate API tokens, integration secrets, and privileged credentials used by ConnectWise tools, and limit standing administrative access.
6. Monitor ConnectWise and Huntress advisories for indicators or guidance, and preserve logs in case the takeover allegation expands.
7. Prepare a short incident communication path for staff and families if suspicious identity activity is confirmed.

Original source

The Register — Security