Good morning!

ConnectWise suspends its cloud backup service after attackers reach its application identities, as OpenCode warns some users' AI provider keys may be exposed. Neither is a password, and neither company will name a suspect.

Here are the 4 things you don't want to miss:

1. 🔒 ConnectWise suspends cloud backup after attackers reach Microsoft 365 tenants

ConnectWise suspended its Cloud Backup service, formerly SkyKick, and two connected services after attackers gained unauthorized access to application identities in the backup environment. The company says it found the problem October 14 and disabled seven identities on October 17. Huntress researchers said sign-in attempts from the attackers' address touched almost 1,000 Microsoft 365 tenants, with more than 300 succeeding. Disabling an app stops its next sign-in, not its last change. (The Hacker News)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 💻 OpenCode's Console breach may have exposed provider keys

OpenCode warned some Console users Saturday morning that provider keys saved in their workspaces may have been exposed, after an intruder reached a legacy system the night before. The company put the affected group at 1.4% of Console users with an outside provider linked and said its command-line and desktop apps keep keys locally and were not involved. It called the incident ongoing. A key pasted into a hosted console stops being yours once it lands there. (The Hacker News)

4. 🏷️ More Rewards tells members their personal details were accessed

Pattison Food Group, which operates Save-On-Foods and the More Rewards loyalty program, said Saturday that customers' personal information in the More Rewards database was accessed after unusual activity on one server Tuesday. The accessed data was names and, where provided, addresses, phone numbers, emails and dates of birth; the company said passwords, credit-card data and transaction history were not accessed. No affected-member count was disclosed. (Global News)

Bonus. Threat Road Tip Of The Day

Five minutes today: list every application and API key your organization has granted to a vendor or pasted into a hosted tool, and note who can revoke each one. Keys you cannot revoke today are keys you do not control.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.