How to Review Your MSP Contract for Cloud Backup After a Cyberattack

ConnectWise found on October 14 that an attacker was using its Cloud Backup app's own credentials to reach Microsoft 365 tenants. They suspended the service on October 17 and began a phased restoration on October 21, according to the ConnectWise advisory. If your MSP runs the tool, your ConnectWise Cloud Backup MSP contract - meaning the master services agreement (MSA) with your MSP - decides when you should have been told, what backups were promised, and who carries the liability.

Say your CEO forwards a headline about the ConnectWise breach with one line underneath: "Were any of our contracts in there?" Here are the facts, and what you can do in terms of next steps.

Choose your next step:

• For contract owners who need the MSA's notice and renewal dates tracked: ContractSafe contract tracking.

• For teams whose signed agreements are spread across SharePoint, OneDrive and Outlook: managing contracts in Microsoft 365.

What ConnectWise Shut Down and Why It Matters for Your Contracts

ConnectWise Cloud Backup, formerly SkyKick, is a Microsoft 365 backup app that MSPs install in client tenants, where signed contracts sit in mail and files. ConnectWise suspended Cloud Backup on October 17 by revoking the certificates for affected application connections and disabling seven application identities at 07:00 UTC, as the ConnectWise advisory reports.

• October 14: ConnectWise dates discovery to this day in its advisory FAQ.

• October 16: ConnectWise first published its security advisory.

• October 18: ConnectWise's October 18 update reported that scheduled backups had stopped and that archive access and restores were unavailable.

• October 21: phased restoration began, though the latest update still tells partners to keep affected connections disabled until formal instructions apply.

Microsoft's threat intelligence team attributes the attack to Storm-0940, a China-nexus group that used an agentic AI tool called ARTEX to attempt sign-ins to more than 2,250 tenants. In some environments the attacker also changed application credentials, a form of persistence that can outlast the original access. Huntress had confirmed unauthorized sign-ins in 162 tenants as of October 16.

The part that matters to you gets less coverage. The attacker signed in with the backup app's credentials, which Microsoft's analysis found needed no interactive user sign-in, so nobody at your company had to lose a password. Huntress's write-up adds that the stolen credential lived in the vendor's own tenant, so nothing a customer did could have produced it.

In its advisory, ConnectWise says its findings don't establish whether any individual tenant was affected, so only your MSP's review of your tenant can answer your CEO. ConnectWise says existing archives remain encrypted, isolated and preserved. Even so, a backup vendor can go dark overnight, so you need to know where every executed contract lives and hold a copy you control.

Follow These Steps in the First Week and Give Each One an Owner

The first week after the ConnectWise suspension needs three owners working from one contract file: the contract owner or finance lead, the MSP account manager, and the general counsel or outside counsel.

A One-Week Checklist for the Contract Owner

1. Pull the paperwork (contract owner). Find the MSA, every statement of work and any backup or security schedule. If the MSA is already loaded in ContractSafe, Google-like search finds it account-wide.

2. Find the notice clock (contract owner). Note what starts the clock in your incident-notice clause. ConnectWise found the problem October 14 and published its advisory October 16, about two days later, so ask your MSP in writing when it learned of the incident.

3. Ask about your tenant (MSP account manager). Ask in writing whether your tenant shows sign-ins from the ConnectWise app, and have the MSP preserve Entra and Purview audit records from at least October 15, as Microsoft's guidance advises.

4. List where executed contracts live (contract owner). Cover SharePoint, OneDrive, Outlook and Teams.

5. Confirm a clean copy exists (contract owner). Check that signed agreements sit somewhere outside the affected tenant.

6. Review who can reach that copy (contract owner). Check which people have access, and have the MSP confirm which apps hold consent in the tenant.

7. Compare notice duties (counsel). Set the MSP's duty to you beside your own notice duties to customers.

Say your MSA gives the MSP seventy-two hours from becoming aware of an incident to notify you. That clause governs your MSP whatever ConnectWise's timeline shows, and no regulatory deadline applies to the MSP's notice to you here, so your own contract sets the obligation.

Which Terms to Check in Your MSP Cloud Backup Contract

Read your signed MSA one clause at a time, judging each contract term against what a good answer looks like. If the MSA and its SOWs are loaded in ContractSafe, Google-like search runs notice, backup and liability across all of them at once.

Incident Notice Clause

A good clause says what triggers notice, how fast notice must arrive, who receives it and in what form. Check whether it covers incidents at the MSP's own vendors, such as its backup provider.

Backup Obligation Clause

A good clause names what's backed up, which vendor runs it, whether restores are promised and what happens if that vendor is suspended, as ConnectWise was in its advisory. For example, an MSA that promises regular backups without naming the tool leaves you no way to know the service had stopped.

Liability Cap and Data Return

Check whether data and security incidents are carved out of the liability cap, and whether you can get your data out without the MSP's tools.

Questions to Send Your MSP When a Clause Is Silent

When your MSA doesn't answer a point, send the MSP account manager these checks in writing:

• Which backup vendor protects our tenant today, and when did you learn it was suspended?

• What notice period applies to incidents at your own vendors, and what starts it?

• Did your review find sign-ins from the ConnectWise app in our tenant, and what did it cover?

• What restores can you promise while a backup vendor is suspended?

• How do we export our data without your tools?

Set a short deadline for written answers, such as five business days, because your own customer notice duties may run out while you wait.

Where Signed Contracts Live and the Tools That Limit Who Can Open Them

Executed contracts at a company running on Microsoft 365 usually end up in four places, and your CEO's question about exposure can only be answered against a list of those places:

• The SharePoint contracts library, where official copies are supposed to live.

• Personal OneDrive folders, where someone saved a signed PDF from an e-signature email.

• Outlook inboxes, where countersigned copies arrive and stay.

• Teams chats, where a final version got dropped for a quick look.

Huntress reports that the Cloud Backup app has broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it's installed, so every place on that list was within reach. For instance, a customer agreement that exists only as an attachment in a former sales rep's mailbox was within reach, and it's easy to leave off your list.

User two-factor wouldn't have stopped this attack, because Microsoft's write-up shows the app authenticated without an interactive user sign-in. What protects the contract record is a copy outside the backup app's consent, with its own two-factor sign-in and folder-level permissions.

ContractSafe includes dual factor authentication and access permissions to folders on every plan. Access is set by folder, tag, user and group, not by individual field, so anyone who can open a contract sees all of it.

How a Backup Your MSP Runs Compares With a Copy of Contracts You Control

Compare a backup your MSP runs with a copy of contracts you control and the difference comes down to purpose: the MSP backup restores your Microsoft tenant, and the copy you control keeps the contract record you answer from.

Keep the MSP backup for restoring a mailbox or library, and use a copy you control for audits, disputes and the CEO's question. If your contracts live in SharePoint and inboxes, you need both.

ContractSafe's downloadable data backups let you download your own copy any time, without the MSP. ContractSafe's offsite backup of all data covers only contracts loaded into ContractSafe; it doesn't cover Microsoft 365 or anything the MSP protects. The finance lead owns that copy and checks it against the location list.

Common Mistakes to Avoid After a Backup Vendor Incident

Five mistakes turn a vendor's incident into your own data incident and leave the contract owner unable to say which agreements were exposed:

• Treating a tenant backup as your contract record. The fix is a copy of signed contracts you control.

• Not knowing which contracts sit in OneDrive folders and inboxes. The fix is the location list, kept current by the contract owner.

• Assuming the MSP's notice clock matches your duties to customers. Say a customer contract requires notice within forty-eight hours, while your MSA gives the MSP five days. Have counsel read your customer agreements.

• Deleting the app to feel safe. Huntress advises disabling the Cloud Backup app rather than deleting it, because deleting it removes the consent record, and Microsoft's security blog says not to delete enterprise applications before evidence is preserved.

• Misreading the review. Microsoft notes that a successful authentication doesn't on its own show data was accessed, so a sign-in doesn't prove contracts were read, and a clean finding doesn't prove they weren't. Ask the MSP what its review of service-principal sign-ins covered, then map its findings to your location list.

Related Reading

• The risks of managing contracts in email

• How ContractSafe's AI search returns only the contracts each person may see

• Filing every signed copy automatically after e-signature, on the Finalize and Maximize plans

How ContractSafe Helps You Keep a Copy of Every Signed Contract

ContractSafe keeps a copy of every signed contract outside your Microsoft tenant, with Google-like search to find the MSP agreement and pull its notice, backup and liability terms. Downloadable data backups give you a copy that doesn't depend on your MSP, and offsite backup of all data covers only contracts loaded into ContractSafe, leaving Microsoft 365 and anything your MSP protects outside its scope.

Dual factor authentication protects sign-in, and access permissions to folders mean one compromised account doesn't open every contract. Your MSP keeps running the tenant backup.

ContractSafe pricing starts at $450/month (Organize plan, billed annually; $540 month-to-month), with unlimited users on every plan. Published pricing comes with no implementation fee, and because users are unlimited, each person can have a folder-scoped login instead of PDFs forwarded by email.