Trusted IT Vendor Compromised: What It Means for Your Business
A recent compromise of tech giant and IT vendor ConnectWise raises some important questions about IT support and cybersecurity.
We’re used to security attacks that target small businesses directly: phishing, email compromise, ransomware, etc. It’s why so many businesses turn to the security experts for help.
But what happens when the experts become the targets?
We’re exploring this recent attack, what it could mean for your business, and what attacks like these uncover about the security IT vendors and providers offer their clients.
Key Takeaways
- What happened to ConnectWise? In October 2026, attackers compromised access associated with ConnectWise Cloud Backup, potentially exposing customer Microsoft 365 environments to unauthorized access.
- What does this mean for your business? Businesses using affected services could face risks to Microsoft 365 data, including emails, OneDrive files, SharePoint documents, and Teams information.
- Is disabling the affected service enough? Not necessarily. Investigations have identified unauthorized credentials that could provide additional access, making further security checks essential.
- What should you do next? Contact your IT provider to determine whether your organization uses affected ConnectWise services and what steps are needed to investigate and secure your Microsoft 365 environment.
- Can an IT vendor guarantee your security? No IT vendor or provider can guarantee 100% security. However, proactive monitoring, a coordinated incident response, and clear communication can help limit the impact of an attack.
What Is ConnectWise Cloud Backup?
ConnectWise Cloud Backup is a backup and recovery service built for managed service providers (MSPs) to protect their clients’ Microsoft 365 data.
Because this application is designed to back up important data, it has access to a wide range of connected Microsoft 365 applications such as mailboxes, OneDrive, SharePoint, and Teams.
And it’s this broad access that makes it such a tempting target for bad actors.
The Attack
On October 15th, security researchers spotted suspicious sign-ins involving the ConnectWise Cloud Backup application (formerly known as SkyKick). These sign-ins allowed the attackers to access Microsoft 365 environments that the Cloud Backup application was authorized to access. In other words, organizations using the affected application could have potentially been exposed to unauthorized access.
You can imagine the Cloud Backup application as someone who works behind the scenes and has been provided with a keycard to access secure business locations. Instead of breaking through security, the attacker gains access to that authorized keycard and uses it to enter areas they shouldn’t. In this instance, those locations are customer Microsoft 365 environments.
Further investigation by Huntress researchers uncovered additional details. In one customer environment, a compromised ConnectWise Cloud Management app for Microsoft Teams assigned itself the Global Administrator role and added unauthorized credentials to other applications within the environment.
By adding these credentials, the attacker could use them as another way to access the environment, even after the original access route has been disabled.
To go back to our analogy, it’s like someone using an authorized keycard to create new access codes for other security systems throughout your building. Even if the original card is disabled, those additional codes can still give them a way back inside.
This is still an ongoing incident, and as ConnectWise states on its Latest Advisories page:
“Our incident response, engineering, and operations teams continue working around the clock with third-party specialists to advance the investigation, complete remediation, and validate services for a safe restoration. We are responsible for restoring service safely and providing clear, timely updates.”
With Cloud Backup still suspended, scheduled backups, archives, and recovery capabilities will remain unavailable. ConnectWise has also suspended its SaaS Security and Cloud Management services while its remediation continues.
Why This Is So Dangerous
When an attacker targets a trusted IT vendor, they typically do so to abuse the access that vendor tools have to their clients’ environments.
It’s like instead of breaking into a single house, an attacker finds a way to access multiple houses in a neighborhood. The neighborhood, in this case, is the IT provider’s clients.
What makes this even more dangerous is that simply disabling the original service may not be enough to stop the attack, especially if the attackers have created unauthorized credentials for other applications within an environment.
Without clear communications from IT vendors and a coordinated response from IT and security teams, these attacks could slip under the radar, leaving sensitive business information, such as emails, shared files, and user data, exposed to unauthorized access.
What Should You Do Next?
Reach out to your IT provider to confirm if they use ConnectWise Cloud backup and are aware of the incident.
ConnectWise has suspended its backup service, but as Huntress has pointed out, this doesn’t necessarily make your Microsoft 365 environment safe.
Security teams must investigate Microsoft 365 applications that could have been affected in the compromise and remove any unauthorized access they find.
And as we always recommend, if you have any questions, just ask. Your IT providers are there to support you, and they should be able to explain what this incident means for your business and what you need to do, if anything, to stay safe.
Should You Trust IT Vendors and Providers?
It’s a question that needs to be addressed. Because if attackers can compromise a major IT vendor like ConnectWise, is partnering with an IT provider enough to keep your business safe?
The answer comes down to the simple fact that cybersecurity is never 100%.
No security tool, IT vendor, or provider can perfectly protect your business, and unless there’s some incredible breakthrough in security technology, it’s going to stay that way. What matters is how quickly threats are spotted and addressed, how well those threats are communicated, and instructions on what to do next.
In the case of ConnectWise, the IT vendor suspended affected services after they identified malicious activity and communicated updates to its partners. At the same time, security researchers at Huntress conducted their own investigation, adding critical information to the evolving threat.
This is the type of collaboration, research, and communication businesses should expect from their IT vendors and providers. Because at the end of the day, your business deserves cybersecurity that takes incidents seriously and communicates openly.
Cybersecurity Isn’t Perfect, but It Is Necessary
A security partner can never – and should never – promise you 100% security. Instead, they should commit to fast response times and a dedication to continuously improving your security posture.
That’s the commitment we make at The 20 MSP.
From our 24/7/365 live service desk and continuous threat monitoring to our reliable disaster recovery solutions, our mission is to help our clients stay protected with proactive, layered security. And it’s all at a monthly, flat-rate service fee.
Looking for a partner dedicated to security? Reach out to The 20 MSP today.
About The 20 MSP
As a leading provider of managed IT services, The 20 MSP serves thousands of businesses nationwide, providing each one with white-glove service, secure and streamlined IT infrastructure, and 24/7/365 support. We believe in building lasting relationships with clients founded on trust, communication, and the delivery of high-value services for a fair and predictable price. Our clients’ success is our success, and we are committed to helping each and every organization we serve leverage technology to secure a competitive advantage and achieve new growth.
