The ConnectWise Compromise: Vendor Risk and ITECS's Petra Partnership

Incident information checked October 18, 2026, UTC. The investigation remains ongoing.

A business can carefully protect its employees' accounts and still face risk through software it has authorized to access Microsoft 365. The ConnectWise incident is a reminder that choosing a provider is only the beginning. Understanding its access, watching for changes, and knowing who can respond matter throughout the relationship.

For ITECS, this reinforces two priorities: continued scrutiny of the platforms we use with clients, and security partnerships that support investigation and response. Our relationship with Petra is part of that approach.

What is confirmed about the ConnectWise compromise?

ConnectWise has confirmed unauthorized access to application identities associated with Cloud Backup, formerly SkyKick. Its October 18 update says it disabled seven application identities and revoked affected credentials. Cloud Backup remains suspended, including scheduled backups and access to restores. SaaS Security and Cloud Management were also taken offline as a precaution. ConnectWise has not announced a restoration time. Read the current ConnectWise advisory.

The vendor says it has no evidence that its stored backup archives were accessed. That finding is separate from whether an individual customer's live Microsoft 365 environment experienced unauthorized activity. The investigation has not established the original credential-exposure mechanism or whether a product vulnerability contributed. It would be inaccurate to describe every ConnectWise product or customer as compromised.

Why application access needs its own investigation

Todyl's investigation describes unauthorized authentication through the Cloud Backup application, using permissions already granted within Microsoft 365. This is application access, not simply someone signing in as an employee. Resetting a person's password is therefore not a complete response to this kind of incident. Todyl explains the application-access mechanism.

Huntress separately reported an affected tenant where attackers elevated an application's privileges and added credentials to other management and security applications. That matters because disabling the original connection may not remove access established elsewhere. These are findings from specific investigated environments, not evidence that the same activity occurred in every tenant. See Huntress's investigation and updates.

ITECS's takeaway is straightforward: containment, investigation, and permission to reconnect are different decisions. A disabled application is a protective measure, not a completed investigation.

What Petra reported to ITECS

In an incident update provided to ITECS, Petra reported that its security operations center had conducted a threat hunt and found no evidence of unauthorized data access or exfiltration in the tenants covered by that assessment. Petra also reported proactively disabling potentially compromised ConnectWise applications in tenants covered by its 24/7 SOC Response service.

Those findings are reassuring, but their scope matters. They describe Petra's assessment at that point in time. They do not establish that every environment is unaffected or that no further investigation will be needed. We are not publishing client identities or private incident records.

Why ITECS values its continued partnership with Petra

ITECS offers Petra as a security service for clients. We value the partnership because monitoring should lead to an understandable response: what was investigated, what was found, what protective action was taken, and what remains uncertain.

In this incident, Petra's communication described its investigation, findings, and protective action rather than leaving the recipient with an alert alone. That is the practical value we want clients to receive from a security relationship. Coverage and response authority depend on the services enabled for the particular client; they should never be assumed from a provider's name.

No partner can eliminate every risk. A useful partnership makes responsibilities clearer and supports informed decisions when the facts are still developing.

Why ITECS does not use ConnectWise

ITECS does not use ConnectWise in its own selected service platform. Our research and evaluation led us to conclude that the platform did not align with our cybersecurity best practices.

That is ITECS's platform-selection judgment, not a claim that we predicted this incident or that every ConnectWise product is insecure. It also does not mean a client's Microsoft 365 tenant cannot contain a ConnectWise or SkyKick connection. Our own platform selection and the applications authorized within a client's environment are separate questions.

ITECS continues to observe, research, and test the platforms and services we use in conjunction with clients. An initial evaluation is not a permanent assurance: access, dependencies, and operating conditions can change.

Four questions business owners should ask their IT provider

Our recommendation is to make vendor oversight concrete:

• What access exists? Ask which connected applications can reach business data and who owns each connection.
• Who can act? Identify the authorized responder and the person responsible for explaining the business impact of disabling a service.
• What does the evidence establish? Separate a suspicious attempt, confirmed access, configuration changes, and confirmed data loss. Ask what visibility is missing.
• Who approves recovery? Require a documented decision about restoring access, not an assumption that a service coming back online means the investigation is complete.

What clients should do now

Follow the instructions provided for your own environment. If a security provider has already taken action, coordinate through that provider rather than independently reconnecting an application. ConnectWise currently advises keeping affected connections disabled, preserving evidence, and reviewing customer tenants, including dormant connections. Businesses using the suspended backup service should also confirm their last available recovery point and the effect of the interruption. Check the vendor's latest response guidance.

For ITECS clients, the next step is a conversation about your actual coverage and environment, not a conclusion drawn from a headline. If you are unsure which applications have access or who owns the response, contact ITECS. Learn more about our managed cybersecurity services and how they fit your business.

Source note: Public incident facts above come from the linked vendor and security-research updates. Petra's actions are attributed to a private partner communication supplied to ITECS, not an independently published investigation. ITECS's platform-selection position is a first-party company statement. Findings and service status may change as the investigation continues.