ConnectWise's backup interruption leaves two recovery questions for Microsoft 365 teams

Can a business recover its data, and who can still reach its live systems? ConnectWise's October 18 update at 01:00 UTC makes those separate questions urgent for customers of Cloud Backup, formerly SkyKick. The company says backups and restores remain unavailable, and that it has also paused SaaS Security and Cloud Management as a precaution during its investigation.

The vendor says existing backup archives are preserved and it has no evidence of access to them. That statement concerns stored archives. It does not establish the condition of a customer's Microsoft 365 tenant or mean that data created during the interruption has been backed up. ConnectWise has not provided a restoration time in this update.

Give recovery coverage its own incident record

For a team dependent on the service, a useful first record is the last confirmed recovery point for each important workload. Compare that point with business changes since then: newly received correspondence, changed documents and operational records. This produces a list of potential recovery gaps, rather than an unsupported assumption that an intact historical archive covers today's work.

A second record should identify which recovery operations are presently available through approved arrangements. Avoid promising a restore simply because an archive exists. The people responsible for business continuity need a usable recovery route, its limitations and a named decision-maker if the interruption continues. These are planning questions, not confirmation of an alternative service's availability.

Containment is not a tenant-wide clean bill

ConnectWise says it disabled seven application identities on October 17 at 07:00 UTC. Its update distinguishes preventing new authentication from reversing earlier tenant changes or dealing with previously issued tokens. Huntress's October 17 investigation update also describes an unauthorized credential added to another application in one customer tenant. That observation should not be generalized into a claim that every customer has persistence.

The contrast with Todyl's October 16 findings is instructive: that responder reported no evidence of persistence through the backup app in the tenants it examined. Different observations reflect different monitored environments; neither report supplies an all-customer verdict.

Organizations should therefore ask their authorized security team to retain the relevant evidence, document application access and assess suspicious changes alongside current vendor guidance. Service restoration, access containment and exposure assessment deserve separate completion criteria. A green service-status indicator would answer only one of those questions.

BijliCoin has not inspected customer tenants or tested containment. The useful development is the clearer separation of operational recovery and identity investigation, with both still requiring environment-specific evidence as the incident evolves.