The news
ConnectWise turned off its SaaS backup, security, and management services on October 19, 2026. The company acted to investigate a security incident. Huntress has alleged that attackers took over Microsoft 365 accounts connected to the platform.
Context
ConnectWise supplies tools that managed service providers rely on to back up client data, monitor security, and administer endpoints. These services run in the cloud and form part of daily operations for many IT teams. The shutdown removes those capabilities until the company completes its review.
Before the outage, the services operated normally. The trigger for the current action is the allegation from Huntress concerning Microsoft 365 account compromises. No other details on scope or duration have been released.
The affected services sit at the center of how many MSPs deliver ongoing support. Backup routines, security monitoring, and remote management all depend on continuous access to the ConnectWise cloud environment. When that access stops, the daily workflows of those providers lose a core component they use to serve their own customers.
Details
The affected offerings cover backup functions, security controls, and management interfaces. The company provided no timeline for restoration. Huntress stated that the incident involved takeover of M365 accounts, but further technical specifics remain limited to that claim.
The Register reported the outage and the Huntress allegation without additional numbers or named customers. ConnectWise has not issued a separate statement beyond the decision to disable the services for the duration of the investigation.
No public information has emerged on how many accounts were involved or whether the reported takeovers extended beyond the Microsoft 365 connections. The decision to disable the full set of services indicates the company is treating the report as serious enough to halt operations rather than attempt a narrower fix.
Why it matters
Service providers that depend on ConnectWise now lack access to the very systems they use to protect client environments. Backup and monitoring stop when the platform is offline, leaving gaps in data protection and threat detection. Account takeovers in Microsoft 365 can give attackers control over email, files, and identity settings that many organizations treat as core infrastructure.
The choice to shut down the services shows an attempt to limit further exposure. At the same time it removes defensive tools from the field, which can slow response for customers who have no immediate replacement. MSPs in this position must weigh the risk of continued use against the cost of temporary disruption.
Incidents that reach the level of account takeover often point to weaknesses in authentication or integration points. When the platform itself is the target, the downstream effect spreads quickly to the businesses those providers serve. Restoration will require confirmation that the reported access paths are closed.
The episode underscores how concentrated risk becomes when critical security and backup functions sit inside a single vendor’s cloud stack. Providers will watch the length of the outage and any later findings on the Microsoft 365 claims to decide whether to adjust their own tool choices. A prolonged outage forces those providers to either accept reduced visibility into client systems or accelerate migration to alternate platforms that may not match the same feature set.
For organizations that already route Microsoft 365 data through the affected services, the loss of backup capability raises immediate questions about recovery options if an unrelated incident occurs during the downtime. The absence of a published timeline keeps those questions open. MSPs must now decide whether to maintain the relationship once service resumes or begin the work of qualifying a second vendor to avoid similar single-point exposure in the future.
---
Sources:
{
"publisher": "The Register",
"title": "ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU",
"url": "https://www.theregister.com/security/2026/10/19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/5303758",
"published_at": "2026-10-19T04:31:00.000Z",
"summary": "Huntress alleges takeover of M365 accounts"
}
No comments yet