A third party vendor, ConnectWise, recently reported attempts of unauthorized access associated with the ConnectWise Cloud Backup environment. ConnectWise has initiated their incident response procedures, and have applied containment measures as they continue to investigate. At this time, according to ConnectWise there is no indication that ConnectWise partner backup data has been accessed. All additional updates related to this incident can be found on the ConnectWise Status Page at status.connectwise.com.
As part of our ongoing security monitoring efforts, the Kaseya Security Operations Center deployed additional detection measures on October 16, 2026, targeting publicly disclosed indicators of compromise. Activity matching these indicators is automatically designated as critical severity and promptly reviewed by our security analysts.
The Kaseya product team has also deployed a fortify action within SaaS Alerts and KSIEM environments to help mitigate this risk further. Please follow the steps below to apply the fortify action:
Action Name: Disable ConnectWise Cloud Backup and Cloud Management apps
Steps to Deploy within SaaS Alerts and KSIEM portal:
Within the left menu, under "Modules", select Fortify → Actions, then perform the following:
- Set Select Product to Microsoft.
- Set Select Organization to the customer's org (or leave it on All), and leave Select Actions on All.
- Click Show Actions.
- Search for Disable ConnectWise Cloud Backup and Cloud Management apps in the search box.
- Under the action's buttons, click the wand icon labelled Apply.
If you feel you have been compromised due to this issue, please contact Kaseya support.
