ConnectWise Cyberattack: Cloud Backup Service Affected
The company ConnectWise recently experienced a major cyberattack directly targeting its Cloud Backup service. This security incident, which occurred on October 18, 2026, in the United States, caused significant disruptions in the management of IT data for numerous users. Faced with the threat, drastic emergency measures were implemented to stem the compromise and protect the entire infrastructure.
This article will also interest you: IT security professionals mostly affected by overwork
If you use the company's solutions, you must pay close attention to the situation and monitor service updates. Technical teams mobilized as soon as the incident was reported, which unfolded over several consecutive days, notably involving key dates such as October 16, 2026, and October 17, 2026. Technical analysis quickly identified specific elements linked to the intrusion, such as the use of seven application identities and the IP address 144.172.64.128, detected as early as 7 a.m. UTC.
In the field of digital security, this type of attack highlights the crucial importance of vigilance and responsiveness. To regain secure access to your services or in case of lost access to your management tools, you can use our solution PassDecryptor to retrieve your passwords and secure your access right now.
What Happened During the ConnectWise Cyberattack
The ConnectWise cyberattack manifested as an IT intrusion that directly targeted the infrastructure of the American company. Investigations surrounding the incident highlighted a precise timeline. Starting October 16, 2026, and October 17, 2026, anomalies began to be detected, culminating in the identification of suspicious activity at 7 a.m. UTC. Analyses notably revealed the involvement of seven application identities as well as the use of the IP address 144.172.64.128.
Faced with the seriousness of the situation, the organization's reaction was immediate to limit the spread of the attack. The company proceeded with a temporary interruption of new backups on its Cloud Backup service. This radical decision, although penalizing for daily operations, was essential to preserve the integrity of the remaining data and analyze the origin of the flaw exploited by the attackers.
Who Is Affected by the Cloud Backup Outage?
The ConnectWise cyberattack and its repercussions directly affect all clients and professionals who rely on the Cloud Backup service for data protection in the United States and worldwide. The operational repercussions are heavy for companies that entrusted the management of their backups to the organization.
Among the direct consequences suffered by users are the temporary interruption of new backups, as well as the complete inability to access existing archives. In addition, file restoration procedures are currently suspended, blocking the recovery of information in case of urgent need. To ward off any spread, the organization also ordered the preventive shutdown of SaaS Security and Cloud Management services.
Why Is This Situation Critical for Your Security?
An interruption of cloud backup services is always a critical event for business continuity. When archives are no longer accessible and restorations are impossible, the ability to deal with a related incident, such as ransomware or hardware failure, is significantly reduced. Since SaaS Security and Cloud Management services were also subject to a preventive shutdown, the entire management and protection ecosystem was put on pause to guarantee overall security.
The presence of precise technical elements, such as the use of seven unauthorized application identities and the tracking of IP address 144.172.64.128 as early as 7 a.m. UTC, demonstrates the complexity of the attack suffered on October 16, 17, and 18, 2026. This situation highlights the absolute necessity of continuously strengthening access controls and identity monitoring within cloud architectures.
How to Protect Your Account and Respond to the Incident
To cope with the consequences of this incident and best secure your working environments, follow these practical recommendations:
-
Stay Informed Through Official Channels
Regularly check communications issued by the company to know the progress of the restoration of Cloud Backup, SaaS Security, and Cloud Management services.
-
Check Your Access and Credentials
Examine the login logs of your professional accounts to detect any abnormal activity or unauthorized access attempt that occurred since October 16, 17, or 18, 2026.
-
Strengthen Password Security
Immediately change your administrator passwords and enable multi-factor authentication (MFA) on all your management tools and cloud platforms.
-
Set Up Alternative Backups
While waiting for the complete restoration of the company's services, use local storage solutions or temporary alternatives to ensure the continuity of your data backups.
FAQ: Everything About the ConnectWise Incident
When did the cyberattack take place?
The incident was officially identified and contained on October 18, 2026, building on events and signals detected as early as October 16 and 17, 2026, specifically at 7 a.m. UTC.
Which services are directly impacted?
The Cloud Backup service is the primary target, resulting in interrupted backups, inaccessible archives, and blocked restorations. SaaS Security and Cloud Management services were also preventively shut down.
What technical clues were identified?
Investigations implicated seven distinct application identities as well as the use of IP address 144.172.64.128.
Where is the company based?
ConnectWise operates its business and suffered this cyberattack from the United States.
Key Takeaways
- Cyberattack suffered by ConnectWise on October 18, 2026, in the United States.
- Direct impact on the Cloud Backup service: stoppage of backups, archives, and restorations.
- Preventive suspension of SaaS Security and Cloud Management services.
- Involvement of seven application identities and IP address 144.172.64.128 as of 7 a.m. UTC.
This incident underlines the potential vulnerability of cloud infrastructures to sophisticated intrusions. By suspending access to its key services on October 16, 17, and 18, 2026, the organization sought to limit the damage. Stay vigilant regarding the security of your own accounts and carefully follow the business resumption instructions.
