ConnectWise Cloud Backup Suspended After Unauthorized Access

En bref

• ConnectWise Cloud Backup was suspended after unidentified parties gained access.
• The vendor is investigating the intrusion and confirmed unauthorized activity.
• The service interruption began around Friday and continued into Saturday.
• Customers should treat backup credentials and recovery plans as potentially exposed.

ConnectWise has taken its Cloud Backup product offline after detecting that unknown parties had reached into the service without authorization. The company spent Friday and Saturday examining how the access occurred and verifying that an intrusion had indeed taken place, according to the facts available. Service suspension followed, leaving customers unable to use the hosted backup platform while the vendor continues its review.

Those affected are organizations that depend on ConnectWise Cloud Backup for protecting and restoring data. For K-12 districts and government agencies, backup platforms are part of continuity planning, so an outage or a possible exposure of backup infrastructure deserves prompt attention even when the full scope is not yet known. The incident does not involve a published CVE, which suggests the concern is operational and access-related rather than a known software flaw with a patch available.

Why it matters: backup systems hold sensitive copies and often have privileged connections into other environments. If an intruder reached the backup service, administrators should consider whether credentials, API keys, or recovery workflows could have been observed or misused. The vendor’s decision to suspend service is a containment step, but it also creates a temporary gap in recovery capability that districts should account for.

Context: third-party SaaS providers remain a concentrated risk for schools. A single provider issue can affect many customers at once, and communication delays can leave local teams guessing. ConnectWise has not, in the facts provided, disclosed the number of customers impacted or whether data was accessed beyond the initial unauthorized entry. Those details will shape the response.

What to watch: vendor advisories with scope, root cause, and restoration timeline; confirmation of whether backups were altered, deleted, or exfiltrated; and guidance on credential rotation. Until then, teams should validate alternate backups and monitor for unusual authentication attempts tied to backup accounts.

À faire maintenant

1. Contact ConnectWise support for incident status and ask whether your tenant’s backup data or credentials were exposed; document the case number.
2. Rotate credentials and API tokens associated with ConnectWise Cloud Backup and any integrated RMM or PSA accounts; revoke stale sessions.
3. Verify that independent, immutable backups exist for critical systems and test a restore from a separate platform.
4. Review authentication logs for the backup service and connected tools for unusual logins, new API keys, or configuration changes around Friday and Saturday.
5. Enable MFA and least-privilege access for all backup administrators; remove dormant accounts.
6. Prepare a communication note for leadership and affected staff about the temporary loss of hosted backup service and fallback procedures.
7. Monitor vendor advisories and do not resume normal backup operations until ConnectWise confirms containment and provides remediation guidance.

Source originale

The Record