ConnectWise is continuing recovery of Cloud Backup, formerly SkyKick, following an incident in which unauthorized access to application credentials associated with the platform was confirmed. In its October 23, 2026 update at 14:00 UTC, the company said restoration testing and security validation remained underway, with capabilities being prepared for a phased return.
The first function expected to return is partner access to restore data from existing backups. ConnectWise anticipates enabling that process early the following week, after successful testing. This timetable describes a planned stage dependent on validation; the October 23 notice does not announce full restoration of the service.
The incident concerns authorized connections between the backup platform and customers' Microsoft 365 environments. Management of these connections is relevant to projects that integrate cloud services into business processes, where application identities, permissions and recovery operations need to be tracked separately for every connected organization.
Affected connections remain disabled pending vendor instructions
ConnectWise asks partners to keep affected application connections disabled until instructions applicable to their service are provided. That requirement remains in the October 23 update. The company is preparing phased customer re-enrollment, supported by documented procedures, video materials and sessions explaining the necessary steps.
The vendor says existing backup archives remain encrypted, isolated and preserved, and that its investigation has found no indication they were compromised. This statement concerns archives managed within its service. Reviews of partners' and customers' Microsoft 365 environments are addressed separately in the company's instructions.
The distinction reflects the access an application identity can hold inside a connected environment. Closing a connection at the provider and replacing its credentials address that channel. Checking for unauthorized changes and persistent access inside an organization's accounts takes place within its own Microsoft 365 environment.
ConnectWise calls for examination of both the partner's infrastructure and every managed customer. The instructions include legacy SkyKick integrations, rather than connections registered under the current product name alone. Resellers, distributors and marketplace partners are asked to pass the information to administrators actually responsible for customer environments.
Credential resets were followed by testing for the return of services
The first public advisory in the current series was published on October 16 at 17:47 UTC. In subsequent communications, ConnectWise described disabling affected connections, strengthening administrative-access protection and bringing in independent specialists. Investigation work continued alongside preparations for recovery.
On October 19, the company completed a reset of accounts and credentials within the affected Cloud Backup environment, according to the update published the following day. Recovery was organized into phases, including checks of core infrastructure and additional examination of sensitive connections before they could be reactivated.
The October 20 notice described scheduled backups, archive access and restores as unavailable. SaaS Security and Cloud Management were suspended as a precaution because they are integrated with Cloud Backup. The company identified the affected functions separately: monitoring and alerting for the former, and user and license management for the latter.
On October 21, ConnectWise announced that controlled restoration stages had begun, with a security review at each step. Subsequent communications retained that approach. In the October 23 update, the company anticipated completing testing by the end of the weekend so that capabilities could be returned gradually.
Access to restores from existing archives is the first capability listed in the recovery sequence. Full service re-enrollment follows later and has its own instructions. This order separates recovery of data already saved from restoration of the complete operational flow between the platform and connected organizations.
Reviews of Microsoft 365 environments continue separately
Technical resources provided to partners cover Microsoft Entra ID sign-in and audit logs, application registrations, credentials and permissions. ConnectWise organized technical sessions to support application of its investigation guide. The stated purpose is to examine partners' own environments and each customer environment managed through the affected services.
The company emphasizes that actions within its own infrastructure do not automatically remove unauthorized access already established in customer accounts. Local reviews therefore continue during service restoration. In practical terms, the analysis concerns identities and changes inside the connected organization, alongside the status reported by its backup provider.
In its October 21 update about the attacker, ConnectWise pointed to a China state-aligned group, based on its own assessment and threat intelligence received from Microsoft. The company associated the operation with an AI framework used for automation. This is the attribution communicated by the vendor, separate from findings about service status and recovery steps.
For its other products and services, ConnectWise says it has no indication of impact from this incident. That distinction refers to the published investigation findings. The compromise of application credentials associated with Cloud Backup does not establish a general compromise of Microsoft 365.
The PHP-related Axcient incident has a separate history
In the same advisory center, ConnectWise also reported on the legacy Axcient Backup for Files portal, temporarily taken offline for measures related to PHP vulnerabilities. On October 22, the company announced that this portal had been fully restored. Axcient backups continued running throughout the portal interruption, according to the vendor.
The company explicitly states that the Axcient situation is separate from the Cloud Backup incident. Restoration of the legacy portal therefore does not represent restoration of the former SkyKick services. For Cloud Backup, the operational reference remains the October 23 update, which keeps affected connections disabled and describes a staged return after security validation.
