{"id":281,"date":"2026-10-23T10:09:31","date_gmt":"2026-10-23T10:09:31","guid":{"rendered":"https:\/\/scoy.ai\/guides\/connectwise-cloud-backup-still-suspended\/"},"modified":"2026-10-23T10:09:31","modified_gmt":"2026-10-23T10:09:31","slug":"connectwise-cloud-backup-still-suspended","status":"publish","type":"post","link":"https:\/\/scoy.ai\/guides\/connectwise-cloud-backup-still-suspended\/","title":{"rendered":"ConnectWise Cloud Backup Has Been Off Since October 17. Restores Are Not Back Yet."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">If your IT company backs up your Microsoft 365 email and shared files with ConnectWise Cloud Backup, the product that used to be called SkyKick, that backup hasn&#8217;t run since October 17. Ask them today whether you&#8217;re on it. The headlines this week are about an AI-run attack. What lands on a small business is plainer: the safety copy of your work is switched off.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I pulled <a href=\"https:\/\/www.connectwise.com\/company\/trust\/advisories\" target=\"_blank\" rel=\"noopener\">ConnectWise&#8217;s own advisory page<\/a> at 10:05 UTC this morning, October 23. It carries 19 updates since October 16. These are the ones that matter, in order:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Saturday the 17th: ConnectWise says it is &#8220;shutting off Cloud Backup application access,&#8221; which &#8220;will interrupt backup services for customers until further notice.&#8221;<\/li><li>Sunday the 18th: &#8220;Scheduled backups are not running.&#8221; Also: &#8220;We do not have a restoration time to share yet.&#8221;<\/li><li>Tuesday the 20th: scheduled backups, archive access and restores &#8220;remain unavailable,&#8221; along with two sister services for security alerts and license changes.<\/li><li>Wednesday the 21st: restoring begins in phases, with a warning that &#8220;the start of restoration does not mean all capabilities are available.&#8221;<\/li><li>Today, in the 01:00 UTC update: getting old backups back comes first, &#8220;early next week.&#8221; Setting the service up again comes after that.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">That&#8217;s six days with no new backups so far. If &#8220;early next week&#8221; means Monday the 26th, it&#8217;s nine days before anyone can pull an old copy out. The page doesn&#8217;t name a day. The old copies are said to be fine: &#8220;Existing backup archives remain encrypted, isolated and preserved, with no indication of compromise.&#8221; What&#8217;s missing is anything newer than the 17th.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Two Counts That Get Mixed Up<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One headline this week calls this an <a href=\"https:\/\/fourweekmba.com\/ai-microsoft-discloses-ai-run-attack-that-reached-2250-tenants\/\" target=\"_blank\" rel=\"noopener\">&#8220;AI-Run Attack That Reached 2,250 Tenants&#8221;<\/a>. A tenant is one company&#8217;s own space inside Microsoft 365. Two numbers are floating around, and they count different things.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Number<\/th><th>What it counts<\/th><th>Who says so<\/th><th>When<\/th><\/tr><\/thead><tbody><tr><td>162<\/td><td>Tenants with confirmed unauthorized sign-ins<\/td><td>Huntress<\/td><td>19:00 UTC, October 16<\/td><\/tr><tr><td>Over 2,250<\/td><td>Tenants the attackers tried to sign in to<\/td><td>Microsoft<\/td><td>October 21<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft says most of that targeting failed. So 2,250 is how many doors got rattled, not how many opened. The 162 was <a href=\"https:\/\/www.huntress.com\/blog\/vendor-credential-enables-unauthorized-access\" target=\"_blank\" rel=\"noopener\">Huntress&#8217;s count<\/a> on the first day, and I don&#8217;t know what it is now.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nobody can hand you your own number, either. ConnectWise says it &#8220;cannot determine through our investigation alone whether a particular customer&#8217;s Microsoft 365 environment experienced unauthorized activity.&#8221; The answer for your company sits in your own sign-in logs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the AI Changed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft says the group behind this used ARTEX, an open-source tool that can run any AI model to automate break-in work, and that in several cases it went from first target to privileged access in under three hours. ConnectWise repeats that, saying the group &#8220;used an openly available agentic AI framework to automate and speed up its operation.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That&#8217;s the AI part: speed. The way in was old. Huntress, writing on October 16, says the stolen item was a vendor credential: &#8220;the credential lives in the vendor&#8217;s own tenant. Nothing a customer did in their environment could have produced it.&#8221; Its post doesn&#8217;t mention AI at all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I couldn&#8217;t load Microsoft&#8217;s page directly, only through a summarizing tool, so I&#8217;m repeating its numbers and checking them against news reports that match. On the AI claim it&#8217;s one source, Microsoft, with ConnectWise relaying it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A faster attacker means less time between a stolen key and an open mailbox. It doesn&#8217;t change the thing you can check. Which outside apps can sign in to your Microsoft 365 without a person at the keyboard?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to Ask Your IT Person Today<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Do you know who runs your backup? Plenty of owners don&#8217;t, and that&#8217;s normal. One email covers it:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Is our Microsoft 365 backed up with ConnectWise Cloud Backup or SkyKick? If so, what&#8217;s backing it up this week?<\/li><li>Have you checked the sign-ins for that app? ConnectWise points admins to the Entra admin center (Microsoft&#8217;s list of who and what can sign in), under Monitoring, Sign-in logs, on the Service principal sign-ins tab, filtered by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. The default user tab won&#8217;t show it.<\/li><li>Is the connection disabled but not deleted? ConnectWise says to keep affected connections disabled until it gives instructions, and Huntress says to disable the app, not delete it.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">If the answer to the first question is no, nothing on ConnectWise&#8217;s page says you&#8217;re affected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;d rather talk it through, <a href=\"https:\/\/scoy.ai\/intake.html?offer=intro\">the free thirty-minute call<\/a> is open. Bring one question about who can get into your accounts.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ConnectWise Cloud Backup (SkyKick) has been off since October 17, and restores are due early next week. Ask your IT person these three things.<\/p>\n","protected":false},"author":1,"featured_media":280,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-news"],"_links":{"self":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts\/281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/comments?post=281"}],"version-history":[{"count":0,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts\/281\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/media\/280"}],"wp:attachment":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/media?parent=281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/categories?post=281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/tags?post=281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}