ConnectWise customers remained unable to back up or restore cloud data Tuesday, while separate breaches at OpenCode and Astemo disrupted AI access and closed online inquiry channels.
The ConnectWise shutdown affected several thousand partners worldwide, Chief Technology Officer David Raissipour told CRN Monday. The company sells its backup service to managed service providers, the outside IT firms that support other businesses.
“Cloud Backup jobs, archive access, and restores remain unavailable,” ConnectWise said in its Tuesday advisory. It suspended the service, formerly SkyKick, Saturday and also paused integrated security-monitoring and cloud-management services as a precaution.
Investigators at Huntress said a compromised vendor credential allowed attackers to sign in to customer Microsoft 365 environments. The firm reported successful sign-ins in more than 300 customer environments. In one, attackers added credentials to other applications.
Disabling the backup integration stops scheduled backups but leaves ordinary email, files and user sign-ins working, Huntress said. Customers face a gap in recovery points while investigating potential unauthorized access.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
ConnectWise said existing backup archives remained encrypted and preserved, with no indication of compromise. It has not announced a restoration time and is telling partners to keep affected applications disabled while reviewing their own and their customers’ environments.
The interruptions echo an August incident at LexisNexis, which took three research and data services offline after detecting unusual activity on vendor-managed servers. The company disconnected from those systems and began rebuilding the applications in a new environment, disrupting customers’ access to due-diligence research, news data and media monitoring.
OpenCode users reported expired keys and failed sign-ins, while others described unexpected charges and suspended Google Cloud projects after a breach of the service’s hosted Console. The cause of every reported access failure remains unconfirmed.
OpenCode said Saturday that the incident affected 1.4% of Console users, specifically a subset with external providers linked. It notified affected users by email. Unauthorized access to a legacy system may have exposed saved provider keys, which allow applications to use paid AI services.
Anthropic and Google said they revoked or blocked affected keys. OpenAI’s Thibault Sottiaux said Monday that shared API customers had access restored and credits consumed in the attack refunded.
The restoration announcement covered OpenAI customers, rather than every provider or suspended project. Co-founder Dax Raad said the breached service was Console, distinguishing it from provider keys used locally in the OpenCode application.
Automotive supplier Astemo suspended all external inquiry forms, including its aftermarket channel, Friday following an intrusion into its data-sharing cloud.
Astemo said attackers used a compromised contractor employee account to access its data-sharing cloud and steal company information. It disabled accounts used by the contractor and confirmed theft of business-contact information relating to about 350 people.
Astemo said it had not confirmed significant disruption to its business operations or found evidence of ransomware on its internal network.
Its corporate inquiry form remained unavailable Tuesday, and its Americas website directs users to the shared inquiry service. Astemo has not announced when the forms will reopen.
