ConnectWise: revoked affected Cloud Backup connection certificates (17 Oct)
Event summary
ConnectWise identified unauthorized access to application identities associated with its Cloud Backup environment and, in a 17 October update quoted by third-party analysis, said it revoked the certificates used for affected application connections and that shared credentials previously used for Cloud Backup are no longer valid. The retrieved source does not provide tenant-level scope or confirm tenant-side remediation.
CHRONOS Wire · October 18 · Alert 5
Publication details
- Published
- Updated
- Revision
- r1
- Source
- Inception Security (analysis)
Cliff Notes
- ConnectWise (quoted 17 Oct) revoked affected connection certificates and said shared credentials are no longer valid; no tenant-level remediation details available in retrieved evidence.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
ConnectWise said someone accessed app identities tied to its Cloud Backup product. On 17 October it revoked the certificates used for the affected connections and said the shared credentials previously used are no longer valid.
Why Urgent Level 3
If unauthorized application identities were abused, customers and MSPs will want to confirm the status of their own tenant integrations and logs promptly; the source confirms revocation and credential invalidation but not tenant scope.
What Changed
ConnectWise, according to a 17 October update quoted in third-party analysis, identified unauthorized access to application identities for its Cloud Backup environment, revoked the certificates used for affected application connections, and said shared credentials previously used for Cloud Backup are no longer valid.
What Is Genuinely New
ConnectWise's 17 October update (as quoted in third-party analysis) states it revoked the certificates used for affected application connections and that shared credentials previously used for Cloud Backup are no longer valid.
CHRONOS Bottom Line
ConnectWise reports it revoked affected connection certificates and invalidated shared credentials (update quoted 17 October); available evidence does not provide tenant-level details or describe tenant-side remediation.
Uncertainties / Known Unknowns
Single third-party analysis quotes ConnectWise's update; no primary ConnectWise posting or tenant-impact metrics were retrieved. No evidence retrieved that tenant-side secrets, service principals, or role assignments were created, removed, or remain.
Detailed Analysis
The only retrieved, verifiable statement is that ConnectWise identified unauthorized access to application identities for its Cloud Backup environment and, per an update quoted on 17 October, revoked the certificates used for affected application connections and stated shared credentials previously used are no longer valid. The retrieved evidence does not provide details about the number of impacted tenants, token issuance, or tenant-level configuration changes.
Sources / Evidence
- 01ConnectWise Cloud Backup: Hunt App Sign-Ins in EntraInception Security (analysis)2026-10-17
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.