The Backup Vendor Became the Incident Plan

Backup is supposed to shorten the bad day. Here is the malenky upgrade nobody ordered: the backup service becomes part of the incident, and the restore button takes the night off.

The vault is preserved. The service is not available.

In its October 18, 2026, 01:00 UTC update, ConnectWise said it disabled seven application identities at 07:00 UTC on October 17 after unauthorized access associated with Cloud Backup, formerly SkyKick. It revoked affected connection certificates. Cloud Backup remains suspended: scheduled jobs, affected archive access and restores are unavailable. SaaS Security and Cloud Management are also offline for review. No restoration time was available in that update.^[1]

ConnectWise says stored archives remain encrypted, isolated and preserved, with no evidence they were accessed. That is not an all-clear for customers’ live Microsoft 365 environments, which the vendor says it cannot independently assess. Previously issued tokens may survive until expiration or invalidation; disabling the original connections does not undo other access already established.^[1]

Count the evidence, not the panic

Huntress’s October 17, 5:15 PM ET update reported sign-in activity from a suspicious address across almost 1,000 Entra tenants, with more than 300 successful sign-ins. In one tenant, it documented a ConnectWise application elevating privileges and adding credentials to two other applications. Huntress removed the unauthorized credential on its own application on October 16.^[2]

Those are attributed observations, not a final victim count or proof of data theft. Huntress says incomplete logging prevents ruling out data reads. ConnectWise likewise warns that a clean log search cannot establish that nothing happened.^[1][2]

The vendor calls for reviews of every managed customer tenant, including dormant connections, and preservation of available records. The full scope and original credential-exposure mechanism remain unresolved.^[1]

The institutional joke, droogies, is architectural. A recovery tool needs powerful access to do its useful job. Trusting that tool does not make the permission disappear; it merely makes the permission easier to forget. When resilience and privileged access share a supplier, the emergency plan needs a plan of its own.