A business can have careful staff, strong passwords and extra sign-in checks, yet still face a problem through an app it trusted to protect its data.
That is the uncomfortable issue behind an unfolding ConnectWise incident involving Microsoft 365 access. The company is investigating unauthorised use of application identities associated with Cloud Backup, formerly SkyKick. Some services are paused while it investigates.
For Malaysian companies, the first question is specific: does your organisation, or the IT provider managing it, use these services? This is not evidence that every Microsoft 365 customer has been affected.
The backup service is paused, but that is only part of the story
In its update at 16:00 UTC on 18 October, ConnectWise said investigation and remediation were continuing, with no new confirmed findings to report.
Its published service information says backup jobs, access to archives and restores are unavailable during the interruption. That creates an immediate operational issue for customers who need to retrieve something, even before their own exposure is established.
The company says it has no indication that stored backup archives were compromised. Keep the scope of that statement intact: it concerns those archives, rather than proving that every connected Microsoft 365 environment is clear.
ConnectWise has also taken protective steps involving related services. An unavailable product does not, by itself, prove that attackers used every product taken offline.
If your business relies on the affected backup service, ask the provider what is currently unavailable and what recovery option remains. Do not assume a normal-looking inbox means the backup and restore process is functioning.
An app has its own access
Most staff recognise the familiar login routine: enter a password, approve a second factor and open an account. Business applications can work differently.
Todyl’s investigation describes access through credentials belonging to a vendor application. The app could act using permissions already granted in a customer’s Microsoft 365 environment, without an employee completing an interactive sign-in.
That helps explain why telling everyone to change their password is not a complete response to this particular route. User protection still matters, but the investigation also has to examine what the app was authorised to do.
Think of it as a separate access arrangement that the company has approved for a service. Checking the employee’s login alone would leave that arrangement out of the review.
The permissions determine the potential reach. They should not be confused with a confirmed list of everything an attacker actually read or changed.
“No confirmed theft” needs careful reading
Todyl says its ability to establish data theft is limited by visibility. Its investigation advises affected organisations to treat data as exposed while the review continues.
That is a precaution based on uncertainty, rather than a finding that every mailbox has definitely been copied.
Huntress has separately described activity involving additional ConnectWise application identities, including a case in which another app was used to make further changes. Different observations in different customer environments should not be rolled into a single claim that the same sequence happened everywhere.
For a business owner, the useful request is for an assessment of your own environment. Ask the IT team what evidence it checked, what it found and what gaps remain.
A reassuring sentence without that scope is difficult to act on. So is a frightening headline that treats technical capability as proof of actual damage.
Give the response a named owner
The US National Institute of Standards and Technology’s small-business cybersecurity guide recommends deciding who has responsibility and authority during an incident. That advice is practical even for a small company using an outside IT provider.
Someone needs to coordinate the technical investigation with decisions about operations. The person handling payroll, the person speaking to customers and the person managing the cloud system may each see a different part of the problem.
Start by identifying the services your company actually uses. A managed service provider may have configured them on your behalf, so the product name may not be familiar to every member of staff.
Then ask who is reviewing application permissions and following the vendor’s current containment guidance. These changes belong with the authorised administrator, who can preserve relevant records and assess the effect on dependent services.
Employees should report unusual activity through a known internal channel. Forwarding an unverified fix around the office can create confusion about which instructions are current.
A backup needs a working route back
NIST also recommends regular backups and testing them. Its recovery guidance calls for checking the integrity of backup data before restoring, assigning recovery responsibilities and putting the most important operations first.
Those are different tasks from merely confirming that a subscription is paid.
For example, a business needs to know which records it would restore first and who can authorise that work. The appropriate order depends on what its operations require, rather than the order in which folders happen to appear.
The US Federal Trade Commission’s small-business guidance also recommends keeping backups separated from the network. That is general resilience advice, not a claim that a particular alternative backup product has been validated for this incident.
If an existing service is paused, work with the responsible team on a documented continuity plan. Do not create an improvised copy of sensitive business data in a personal account just to feel that something has been done.
Ask for an update you can use
A useful provider update should distinguish containment, investigation and restoration. Stopping further access does not automatically explain earlier activity, and restoring a service does not automatically answer every question about exposure.
NIST recommends communicating securely with the people who need to know, documenting recovery and reviewing lessons afterwards. For a small business, that can begin with a clear record of decisions and the next expected update.
There is no confirmed Malaysian victim count in the sources reviewed here. The immediate relevance is to organisations using the affected service or connected vendor apps.
Keep following ConnectWise’s advisory through its official trust centre. The most useful question for your IT provider today is concrete: have you checked our application access, and can we still recover the business records we depend on?
Sources & further reading
Prepared with AI assistance from linked reporting. The cover is an AI-generated editorial illustration. Spotted something we should correct?