Small businesses regularly give trusted cloud applications permission to work with email, files, user accounts, backups, and other Microsoft 365 data. Those connections are convenient, but they can also become an important security concern when a vendor experiences an incident.
ConnectWise recently reported unauthorized access involving application identities associated with its Cloud Backup service, formerly known as SkyKick. The company suspended Cloud Backup, SaaS Security, and Cloud Management while investigating, resetting credentials, and preparing for a controlled restoration.
This does not mean every ConnectWise or former SkyKick customer was compromised. It does mean affected businesses should make sure someone qualified is reviewing their Microsoft 365 environment and current backup coverage.
An application identity is the digital identity a cloud application uses to connect to another service. It allows an application to perform approved tasks without an employee signing in every time.
A backup application may need access to mailboxes, OneDrive, SharePoint, Teams, or directory information so it can protect that data. Depending on the permissions granted, that access can be extensive.
ConnectWise stated that it identified unauthorized access to application identities associated with Cloud Backup. The company disabled affected connections and reset accounts and credentials within the affected environment.
ConnectWise also cautioned that disabling those connections prevents new authentication but does not automatically reverse changes that may already have been made inside an individual Microsoft 365 environment.
In its October 21 update, ConnectWise said Cloud Backup, SaaS Security, and Cloud Management remained suspended while remediation and security validation continued.
The company said existing backup archives remained encrypted, isolated, and preserved, with no indication that those stored archives were compromised. However, those findings do not determine whether an individual customer’s live Microsoft 365 environment experienced unauthorized activity.
The suspension also affected scheduled backup jobs, access to backup archives, restoration capabilities, security monitoring, alerting, and some user-management functions.
For a small business, that creates two separate questions:
Both questions deserve clear answers.
Business owners do not need to investigate technical logs themselves. They should ask the person responsible for Microsoft 365 and backups to confirm that the published vendor guidance has been reviewed.
Useful questions include:
Technical advisories may recommend disabling a cloud application while preserving its configuration for investigation and eventual restoration. Deleting an application can remove consent information and make recovery or analysis more difficult.
Employees and business owners should not make these changes through trial and error. The review should be performed by an administrator who understands Microsoft 365 application identities, audit records, backup retention, and the vendor’s current instructions.
Similarly, do not rely on changing employee passwords alone. This incident concerns application access rather than an ordinary employee password, so a password reset may not address the relevant connection.
The broader lesson is not limited to one vendor.
Small businesses frequently connect scheduling platforms, backup tools, accounting integrations, email-security products, signature services, customer-management systems, and AI applications to Microsoft 365.
Every connected application should have:
A trusted application should not remain connected forever simply because nobody remembers why it was installed.
The incident also demonstrates why backup planning should include more than storage.
Ask when the last successful backup occurred, what information it contains, how long it is retained, and how quickly it can be restored. Document what the business will do if its primary backup or management platform becomes temporarily unavailable.
Himala and his team at Cybernetic Networks have been amazing. We have been a customer of Cybernetic Networks for well over 14 years now, both personally and professionally. Himala and his team are professional, reachable and on the cutting edge of technology. We have enjoyed doing business with Cybernetic Networks for many years and still rely on their knowledge, skills and technology every day
Himala and his Cybernetic team have never let me down! For over 10 years now they have been fixing my technical issues, set up all my new networks and computers and have safeguarded me from any hackers or malware. You can trust this company to navigate you as your company grows and to keep you on track with the latest in security and safety
I am a solo practicing neurologist and have had all my IT needs covered through Cybernetic Networks since 2007. They are the best! All of their tech support staff is extremely knowledgeable and efficient. Just as importantly, they are quickly responsive whenever we need their assistance. I couldn’t be happier with their service and give them my highest recommendation!
I couldn't be happier with Cybernetics - they are experts, always respond quickly , and solves any issues I have.
Cybernetic Networks has been advising and supporting all our IT issues and purchases for the last 18 years. They are very responsive and extremely knowledgeable- always providing us with timely services.
It is not often you find small business companies that are not only rewarding to work with, but also have integrity, truth and skill. I have worked with this company for over 20 years, and the service is outstanding. I can easily recommend that if you need an IT company, this is the one to get. Full STOP! Look no further, you will be happy that you did. Sue Myhelic, Gulf Breeze Real Estate, Naples, Florida.
Himala and his team from Cybernetic Networks, Inc. has been an integral part of our successful retail business for the past 20 years. He is extraordinarily knowledgable and always available for our IT needs. Thanks to Himala and his team we are always up and running.
