ConnectWise Suspends Cloud Services Following Cyberattack

ConnectWise has suspended a set of cloud services in response to a cyberattack, taking systems offline while it investigates the incident and works to restore safe operations for its managed service provider customers.

The company, whose remote access and management tools sit at the heart of thousands of IT operations run by MSPs, confirmed the suspension after detecting the attack. Taking cloud services down entirely is a drastic move for a vendor of this size — it trades short-term customer disruption for containment, and it signals that ConnectWise engineers could not rule out ongoing adversary access to the affected infrastructure.

What happened?

ConnectWise detected a cyberattack affecting its environment and responded by pulling cloud services offline. The suspension means customers who rely on those hosted services lost access while the company assessed the scope of the intrusion.

For context on why this matters: ConnectWise is one of the largest vendors serving the MSP channel. Its tools are used by service providers who in turn manage IT for vast numbers of downstream businesses. A compromise at this layer of the stack doesn't stop at one company — it can cascade across every customer an MSP supports.

SecurityWeek, which first reported the suspension, notes the move mirrors a pattern seen in previous channel-side incidents: when a vendor cannot verify the integrity of its own infrastructure, the safest option is often to switch it off.

What does this change for MSPs and their clients?

The practical question for CIOs and MSP operators is straightforward: if your remote monitoring, management or remote access workflows depend on ConnectWise cloud services, you need a fallback. That means:

• Confirming which ConnectWise services are suspended and which remain available.
• Checking whether on-premises deployments are affected or can carry critical workloads.
• Communicating proactively with end customers about potential service gaps.
• Reviewing integrations and automations that silently depend on the suspended services.

There's also a defensive angle. Incidents at management-tool vendors raise the possibility that attacker activity preceded the shutdown. Prudent teams are reviewing authentication logs, privileged account activity and any unusual remote sessions on the customer side while the investigation unfolds.

Why vendors pull the plug

Shutting down revenue-generating cloud services is not a decision any vendor makes lightly. It typically indicates one of two things: either the attacker had, or may have had, sufficient access that continued operation risks further compromise, or the company needs the systems static to preserve forensic evidence.

Either way, customers should treat the outage as more than a availability problem. Until ConnectWise publishes findings on what was accessed and how, the assumption worth working from is that anything routed through the affected services during the intrusion window deserves scrutiny.

ConnectWise has said it is working to restore services and has encouraged customers to follow its official advisories for updates. The company has not yet detailed the full scope of the attack, the affected service list, or the timeline for restoration.

For the MSP channel, the episode is another reminder that vendor risk is operational risk. The tools you use to run and secure client environments are themselves part of your attack surface — and when your provider goes dark, so does part of your business.