A backup should help your business recover from trouble. But what is your plan when the backup service itself becomes unavailable?
That question matters this week. On October 17, 2026, ConnectWise announced it was shutting off Cloud Backup application access after identifying unauthorized access to application identities. The service was formerly known as SkyKick. Source: ConnectWise Product and Services Status (https://status.connectwise.com/). ([status.connectwise.com](https://status.connectwise.com/))
For business owners, our takeaway is straightforward: ask about both the security of your Microsoft 365 environment and your ability to recover important information. Treat those as separate questions, with separate answers.
What happened, and what remains uncertain
Huntress reported that a compromised credential belonging to ConnectWise Cloud Backup was used to gain unauthorized access to customer Microsoft 365 environments. This involved an application’s access, rather than simply a stolen employee password. Source: Huntress investigation (https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access). ([huntress.com](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access))
ConnectWise’s October 20 update says remediation includes resetting accounts, replacing application credentials and validating the environment before restoring service. Its status page describes interruptions affecting backup jobs, archive access and restores. This remains a developing incident; check the vendor’s current guidance before making operational decisions. Source: ConnectWise Product and Services Status (https://status.connectwise.com/). ([status.connectwise.com](https://status.connectwise.com/))
ConnectWise has said it has no indication that its encrypted backup archives were compromised. However, it also explains that this finding does not establish whether individual customers’ live Microsoft 365 environments were affected. An intact backup archive is not the same thing as a clean bill of health for your business systems. Source: ConnectWise Product and Services Status (https://status.connectwise.com/). ([status.connectwise.com](https://status.connectwise.com/))
Start by confirming whether you are affected
Ask your IT provider to identify the actual services behind your backup arrangement, including services purchased through a reseller. Request a written answer covering current connections and any older integrations that remain in place.
If ConnectWise Cloud Backup or former SkyKick services appear in that inventory, ask who is responsible for reviewing your Microsoft 365 environment against the vendor’s investigation guidance. Request an owner, a progress update and a record of the findings—not just confirmation that someone has seen the announcement.
Avoid asking employees to disconnect applications themselves. Have your administrator coordinate changes, preserve relevant records and follow the vendor’s restoration instructions.
Ask about application access, not only passwords
Huntress observed attackers adding credentials to other applications in a customer environment. That matters because an investigation cannot stop at the original compromised connection. Source: Huntress investigation (https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access). ([huntress.com](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access))
Ask your administrator to explain what was checked: application sign-ins, permissions, newly added credentials and unexpected administrative changes. You do not need to interpret the logs yourself. You do need to know whether the review is complete, whether anything suspicious was found and what remains unresolved.
For the longer term, request a regular review of connected applications. Give each integration a business owner, a documented purpose and a review date. Ask your IT team to assess whether its permissions still match its job.
Make the recovery discussion concrete
For each business-critical system, ask for the last confirmed successful backup and the last successful restore test. Then ask what you could recover today if your usual backup portal were inaccessible.
Start with the information your team needs to operate: customer records, shared documents, finance data and essential communications. Decide how much recent work you could reasonably recreate and how long each function could pause.
Have your provider assess whether an independent recovery option is appropriate. Do not respond by scattering sensitive files across personal devices or unmanaged storage. Any temporary protection should have approved access controls, an accountable owner and a clear retirement plan.
Assign decisions before the next interruption
We recommend a short continuity exercise with leadership and IT. Assume the normal restore service is unavailable. Who approves an alternative? Who communicates with staff? Which locations or teams get priority? What evidence is required before reconnecting a suspended service?
Write down the answers and test them. The goal is not a promise that nothing will fail. It is a practical plan for making informed decisions when something does.
Magic Touch Computers is Your Global IT Department, providing business IT services since 2003 from Calgary to businesses internationally. To review your backup, cloud access and business continuity arrangements, contact Magic Touch at (403) 770-6652, magictouchit.ca/contact, or take the free AI IT assessment at magictouchit.ca/it-assessment.
— The Magic Touch Team