Act
active
ConnectWise Resets Credentials After Cloud Backup Breach
- Engineer — Act: If you use ConnectWise Cloud Backup or any ConnectWise integration, treat your application credentials as potentially compromised — audit all API keys and service accounts tied to ConnectWise products and rotate any that weren’t already force-reset by the vendor.
- SOC/IR — Act: ConnectWise has deep access to managed environments; if any ConnectWise agent or integration operates in your estate, initiate an assume-breach sweep for anomalous activity from those service accounts since the incident began, even absent published IOCs.
- Leader — Act: Confirm whether your organization or an MSP you depend on uses ConnectWise Cloud Backup, then request a formal incident attestation from ConnectWise; the service remains offline, which may affect your RTO/RPO commitments and warrants a backup-continuity briefing to leadership.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.