17/10/2026
If your business uses ConnectWise Cloud Backup, directly or through an IT provider, please check the latest update and speak with the team responsible for your backups.
ConnectWise has confirmed unauthorised access to application identities within its Cloud Backup environment. It is shutting off application access as a protective measure, interrupting backup services until further notice.
As of its 06:11 BST update on 17 October, ConnectWise reports no indicators that partner backup data has been compromised. It says existing backup archives are unaffected by the interruption and will be accessible once services are restored. The investigation remains ongoing.
For business owners, our advice is to ask your IT provider to confirm whether you are affected, when your last successful backup completed and what the interruption means for your recovery arrangements. Make sure someone is responsible for tracking updates and confirming that backups resume successfully.
For technical teams, ConnectWise directs checks to Microsoft Entra’s Service principal sign-ins, rather than the default User sign-ins tab, using application ID:
506e08f9-6e9a-4da4-942b-a099a03644ae
It identifies 144.172.64.128 as a suspicious source IP. A matching indicator warrants investigation; it does not, by itself, confirm compromise.
Preserve relevant logs, review unusual application activity and permission changes, and follow the latest vendor guidance as the investigation develops.
There is an important distinction between an existing backup archive being intact and new backups continuing to run. Businesses need to understand both, particularly if the interruption continues.
Please give the teams investigating this room to do their work. Share verified information, explain the practical impact to your customers and be clear about what remains unknown.
Official updates: https://lnkd.in/eB5U6Mnd
hashtag hashtag hashtag hashtag