Cloud Backup Attack Disrupts Recovery, Plus 2 Stories
A backup service has two jobs: make a usable copy, then give it back when something goes wrong. ConnectWise customers now have to deal with a security incident that touches both sides of that promise. The company has shut down Cloud Backup while it investigates misuse of trusted application identities, which means scheduled backups are not running and restores are unavailable.
ConnectWise shuts down Cloud Backup after attackers enter Microsoft 365 tenants
The ConnectWise Cloud Backup attack is a useful reminder that software accounts can be as powerful as human administrators. Cloud Backup, formerly SkyKick, uses application identities to copy mail, OneDrive, SharePoint, Teams and directory data from Microsoft 365. Think of an application identity as a service account for software. It signs in without a person typing a password, and it receives whatever permissions an administrator granted it.
Huntress says an attacker abused a credential belonging to the vendor and used it to get Microsoft Graph access tokens in customer tenants. As of 7 p.m. UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. ConnectWise disabled seven application identities at 7 a.m. UTC on October 17 and revoked certificates used by the affected connections.
That stops new authentication through those connections. It does not undo anything the attacker may already have changed. A stolen master key can be canceled, but you still have to check whether somebody made another key while the door was open.
ConnectWise says its encrypted backup archives remain isolated and preserved, with no evidence they were accessed. That is reassuring, but it is a different question from what happened inside live Microsoft 365 tenants. The company says scheduled backups are not running, access to archives and restoration are unavailable, and it has no restoration time to share yet. In other words, the copies may still exist while the recovery path is temporarily closed.
If your business or IT provider uses ConnectWise Cloud Backup or an older SkyKick connection, this needs attention now. ConnectWise tells partners to keep the affected apps disabled, preserve logs, and review activity from October 13 forward. The review includes service-principal sign-ins, newly added credentials, directory roles, consent grants, policy changes, mailbox forwarding, inbox rules and delegated mailbox access. Do not delete the application as a first step, because that can erase configuration and evidence needed for the investigation.
If somebody else manages this for you, ask three concrete questions: Are any of our tenants affected? What is our last successful recovery point? Who is checking for access the attacker could have created after the original sign-in? A clean search is not a guarantee, and a successful sign-in does not prove data was copied. ConnectWise makes both points in its guidance. That is the right level of caution, not panic and not a shrug.
This is also why a backup design has to include more than a green “job completed” message. Who can change the backup integration, who can erase live data, and who can restore when the vendor itself is offline? Our recent Veeam backup coverage reached the same practical conclusion from a different direction: recovery systems need their own security and a tested way back.
Backups & recovery
Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.
An electronic price tag is not automatically surveillance pricing
Retail pricing technology is becoming visible enough that several different systems are getting lumped into one alarming idea: the store sees you coming and raises the price. The concern is understandable, but the mechanisms matter.
An electronic shelf label is a screen that replaces paper and makes updates easier. Dynamic pricing changes a price for everyone in response to demand, inventory or competition. Personalized pricing uses information about a person or group, such as location, browsing behavior or estimated willingness to pay, to change an offer. An algorithm can support either of the last two, but the presence of a digital label proves neither one.
The Associated Press reports that rapid adoption of digital labels and loose use of terms like “AI pricing” have fed public suspicion. Walmart says its labels do not scan people or phones and are not used to raise prices based on the shopper, weather or time of day. At the same time, opacity is a real problem. The FTC’s proposed enforcement policy says the agency cannot ban personalized pricing in every circumstance, but failing to disclose it and the personal data behind it may be unfair or deceptive.
For shoppers, the sensible response is verification rather than viral certainty. On an expensive or recurring purchase, compare the shelf, app and logged-out web price, then keep the receipt or screenshot if a difference matters. Prices can legitimately vary by store, channel or loyalty promotion, so a mismatch is a reason to ask, not proof that facial recognition priced your cereal.
For retailers, the lesson is blunter: know what data goes into the pricing system and what customers are told. Calling every optimization tool “dynamic” does not answer whether personal data changes an individual offer. Regulators and customers are asking the narrower question now.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Meta removes website-content language from its commercial terms
Meta has removed a clause from its upcoming commercial terms after legal experts said the wording could give the company broad rights to use content from domains and URLs connected to its business products. The disputed language was scheduled to take effect October 30 and referred to using content to develop, improve, research and train Meta products.
The Verge reports that Meta pulled the wording after Nieman Lab and legal scholars raised the concern. Meta says the terms applied only to ads and business products, did not change its crawler practices, and did not override website owners’ preferences in robots.txt. Removing the clause is useful, but it does not settle the broader argument about AI training and publisher consent.
There are three separate controls here. A contract describes rights between parties. A robots.txt file sends instructions to automated crawlers. Server rules can actually deny a crawler access. None is a perfect substitute for the others. Site owners using Meta business tools should keep a copy of the terms they accepted, maintain crawler and access logs, and review which domains and content they connected. That is ordinary governance, not a call to rip out every integration.
I think the most important detail is the reversal itself. Meta maintained that critics had misunderstood the clause, then removed the language because it was broad enough to create the dispute. If a platform does not mean to claim a sweeping right, the contract should not require a law professor to explain why the words supposedly mean something narrower. Owning more of the publishing workflow, as we discussed in our open source SEO and social media tools guide, also makes it easier to see and control these dependencies.
Content & search
SEO isn’t a magic field hidden in your admin settings. Useful structure, understandable copy, good metadata, sensible internal links, and content worth landing on still do most of the work. Raymond Tec helps businesses improve the whole publishing system instead of chasing one green score.
All three stories come back to the same question: what authority did we give the software, and what happens when the convenient layer stops behaving as expected? A backup integration can inherit tenant-wide access. A pricing system can turn ordinary data into individualized offers. A platform agreement can reach beyond the platform to a business website. The practical work is not banning every tool. It is knowing the boundary, keeping evidence of what changed, and making sure the company operating the system is not the only party capable of explaining it.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- ConnectWise Trust Center: Cloud Backup investigation and service update
- ConnectWise product and service status
- Huntress: vendor credential abused in Microsoft 365 attacks
- Associated Press: AI-enhanced pricing tools and consumer concerns
- FTC: proposed enforcement policy statement on personalized pricing
- The Verge: Meta removes disputed commercial-terms language
- Nieman Lab: legal analysis of Meta’s earlier terms
Photo by Christina Morillo on Pexels.
