ConnectWise Cloud Backup Attack: Website and Lead-Handling Checks for Local Businesses

What local businesses should check after a vendor or cloud-security incident

Reports describe a ConnectWise-related supply-chain incident involving Microsoft 365 tenants. According to The Hacker News, ConnectWise suspended its cloud backup service after attackers compromised Microsoft 365 tenants. BleepingComputer also describes the event as a supply-chain attack involving Microsoft 365 tenants.

That does not mean every ConnectWise customer or Microsoft 365 tenant was affected. It also does not prove that local businesses lost leads, had websites go offline, or missed customer messages.

But the incident is a useful prompt for local business owners: if a provider, email account, backup system, or CRM becomes unavailable, can customers still reach you—and can your team still respond?

If you believe your business may be affected, contact your IT provider or the relevant vendor promptly and follow its incident guidance. A website checklist is not a substitute for account investigation, containment, credential work, or professional security support.

Table of contents

• Separate technical response from customer communication
• Map the vendors connected to your website and leads
• Check where every website inquiry goes
• Keep an alternate contact route available
• Review access without making rushed changes
• Verify backups and recovery contacts
• Create a manual lead-follow-up plan
• Make temporary website updates only when needed

Separate technical response from customer communication

There are two different jobs during a vendor or cloud-account problem:

1. Investigate and secure the affected systems. This belongs with your IT provider, managed service provider, internal administrator, or the affected vendor’s incident process.
2. Keep customers informed and reachable. This is where your website, phone number, alternate inbox, and staff process matter.

Do not publish speculative details about an incident on your site. Avoid telling customers that systems are secure, compromised, or fully restored unless you have verified information you are authorized to share.

Instead, focus on the practical customer-facing question: can someone request service, call your business, or get an answer if normal email or software access is disrupted?

For a related framework on handling a software disruption, see Salesforce outage response checklist for local businesses.

Map the vendors connected to your website and leads

Many local businesses use more third parties than they realize. A website inquiry might touch several systems before a staff member sees it.

Create a simple one-page map of the tools involved in customer communication:

You do not need a technical diagram. A spreadsheet or document is enough if it shows:

• The vendor name
• The account owner
• The login administrator or IT contact
• The business function it supports
• Whether customers would notice if it became unavailable
• A backup contact method

This inventory helps you ask better questions if a vendor reports an incident. It also prevents a common continuity problem: everyone assumes someone else knows where website leads are delivered.

Check where every website inquiry goes

A contact form that looks normal on the website can still fail behind the scenes. The page may load, the visitor may see a confirmation message, and the business may never receive the inquiry.

Test each customer path—not just your main contact page.

Test the forms customers actually use

Submit a clearly labeled test inquiry through:

• Your main contact form
• Quote or estimate request forms
• Booking or appointment forms
• Service-page forms
• Newsletter signups, if staff monitors them
• Website chat, if you use it

For each test, confirm:

1. The form shows a clear confirmation after submission.
2. The notification reaches the intended inbox or system.
3. Any CRM, calendar, or automation connection receives the lead.
4. The team member responsible for replies can access it.
5. The customer receives an expected acknowledgment, if your form sends one.

Use a harmless subject line such as “TEST—Please Ignore” so staff do not mistake the submission for a real request.

If you cannot access the connected email, CRM, or other platform, do not assume the form works. Record the form URL, the usual recipient, and the point where verification stopped. That information will help your IT provider or website provider investigate.

For a closer look at form design and the information to collect, read Local business lead form fields: what to ask and what to leave out.

Look for silent failures

A form may be at risk of being overlooked if it sends notifications to:

• One employee’s personal work inbox
• An inbox that no one checks during absences
• A former employee’s address
• A shared mailbox with unclear ownership
• A CRM queue without an assigned staff member
• An automation chain with no manual fallback

The goal is not to add more systems. It is to know which system is responsible for the next step after a customer clicks “Submit.”

Keep an alternate contact route available

If email access or form notifications are uncertain, customers need a visible way to reach a real person.

Your alternate route should be independent enough to remain useful if your usual inbox, CRM, or vendor portal is unavailable. Depending on your business, that may be:

• A monitored business phone number
• A text-capable business number
• A temporary alternate email address you can access
• A staffed physical location
• A verified social profile with messages monitored by a named employee

Do not add a temporary channel unless someone can actually monitor it. An unstaffed contact option may create more frustration than it solves.

Put the fallback option in visible places

If your normal inquiry process may be disrupted, consider placing the alternate contact method:

• Near the primary website call to action
• On the contact page
• In the website header or announcement area
• On service pages that receive frequent inquiries
• In your Google Business Profile, if appropriate

Keep the message factual and short. For example:

We’re currently experiencing an issue with our usual online message system. For the fastest response, please call us at [phone number].

Only use language you can support. Do not claim that customer information is safe, that a security incident is resolved, or that a particular system is unaffected unless the appropriate provider has confirmed it.

Your phone number also needs to be easy to find and use on mobile devices. Review Why your local business website has to work on a phone first for the basics.

Review access without making rushed changes

Vendor-related incidents can expose a basic operational weakness: the business does not know who has administrator access to important accounts.

Document the people and providers who can access:

• Your website hosting account
• Domain registrar and DNS settings
• Microsoft 365 or business email administration
• Website forms and form-notification settings
• CRM or booking software
• Analytics and tag-management accounts
• Backup dashboards
• Social media business accounts

For each account, identify a current business owner—not merely the person who originally set it up.

If there is an active incident, coordinate changes with your IT provider or the vendor’s documented process. Unplanned access changes, deleted integrations, or rushed website edits can make troubleshooting harder. The useful business-side task is to provide an accurate list of systems, owners, and recent access—not to attempt forensic work yourself.

For broader website account hygiene, see Local business website security: how to avoid exposing passwords in shared Google Docs.

Verify backups and recovery contacts

A backup is only useful if you know what it covers and who can verify it.

Ask your IT provider, hosting provider, or backup vendor these practical questions:

• Is the website included in backups?
• Are form settings, website content, and database content included where applicable?
• How often are backups made?
• Where are backups stored?
• Who receives failed-backup alerts?
• Who can request restoration if the usual contact is unavailable?
• Are there separate backups for email, files, and the website?

Do not assume that a cloud backup service protects every connected business system. Website hosting, email, Microsoft 365 files, form data, CRM records, and locally stored documents may have separate backup arrangements.

The immediate goal is not to perform a restoration. It is to confirm the responsible contact, scope, and recovery path before you need them.

Create a manual lead-follow-up plan

If email, CRM access, or automated form routing becomes unreliable, your business can still prepare to handle possible inquiries manually.

Assign three roles:

A basic manual lead log can include:

• Date and time
• Customer name
• Phone number or email
• Requested service
• Location or service area
• Preferred contact method
• Staff member assigned
• Follow-up status
• Notes on urgency or appointment availability

Keep the log limited to the information you genuinely need. Avoid collecting sensitive details through improvised channels. For a useful privacy review, see Local business website lead form privacy checklist.

Decide how staff will recognize a real inquiry

During a disruption, inconsistent handoffs are a common issue. Tell staff:

• Which alternate contact channels are active
• Who is checking each channel
• Where to record inquiries
• Who may contact customers
• What to say if the usual booking, quoting, or email system is unavailable
• When to escalate a customer request

A short internal message is enough:

Until further notice, log new website and phone inquiries in the lead sheet. Do not promise appointment times through the unavailable system. Route urgent requests to [name and phone number].

This is a continuity measure, not a replacement for repairing the affected systems.

Make temporary website updates only when needed

Not every vendor-security event requires a public website notice. If your contact forms, email, and normal response process are working, changing the site may only confuse visitors.

A temporary update is more appropriate if customers could otherwise use a contact route your team cannot monitor.

Use a narrow, practical notice

Keep any message focused on customer action:

• State the communication issue without speculating about cause.
• Give one reliable alternative contact method.
• Remove the notice when normal operations resume.
• Check that the alternate phone or inbox is actually monitored.

Avoid publishing technical details, incident theories, security promises, or customer data-related statements unless your qualified technical or legal advisers have approved them.

If your website itself becomes unavailable, the continuity steps in Google outage response checklist for local businesses can help you prioritize customer communication and lead handling.

A five-minute owner checklist

If you only have time for the essentials, do these checks:

• [ ] Confirm whether your IT provider or relevant vendor has contacted you about the incident.
• [ ] List the vendors connected to your website, email, forms, backups, and CRM.
• [ ] Submit one test inquiry through your main contact form.
• [ ] Confirm the inquiry reaches a person who can reply.
• [ ] Check that your business phone number is visible and monitored.
• [ ] Identify one alternate customer-contact method.
• [ ] Name the person responsible for recording new leads if normal systems are unavailable.
• [ ] Confirm who owns administrator access to your website, domain, and email accounts.
• [ ] Ask the responsible provider what is backed up and how recovery requests are handled.

Keep the website’s customer path simple

The ConnectWise-related reports are a reminder that local businesses depend on connected vendors for email, backups, forms, websites, and customer communication. The reported event does not establish that every provider customer was affected, nor does it establish a local-business lead-loss trend.

Still, a clear website contact path, a tested form, an alternate contact route, and an assigned manual follow-up process can help your business prepare if a technology disruption affects normal operations.

StoopCraft builds websites for local businesses and performs on-page SEO as part of its $99/month service. If you need help making your contact path clearer or reviewing whether customers can find the right next step on your site, visit StoopCraft.