Lessons from the front line.

Two incidents this month involved services used by IT providers to manage customer backups.

Security firm Huntress reported active exploitation of AhsayCBS, a backup-management platform. Ahsay said it began receiving partner reports of unauthorised access on 9 October and later issued replacement fixes after confirming that earlier patches had not fully addressed two vulnerabilities.

Separately, ConnectWise suspended its Cloud Backup service, formerly SkyKick, after identifying unauthorised access to application identities used by the service to connect to customer systems. Huntress reports that a compromised Cloud Backup credential was used to gain unauthorised access to customers’ Microsoft 365 environments.

The incidents are different, but both raise a useful question for smaller organisations: how do you know that the service protecting your data is itself being protected properly?

Two incidents, two different exposures

In the Ahsay case, the backup platform itself was reportedly attacked. Huntress advises a full rebuild of any server found to be compromised, a reminder that patching closes an entry point but does not necessarily remove access an attacker has already established.

In the ConnectWise case, the reported issue was the access a backup supplier held into customer systems.

There is an important distinction here.

Public reporting on Ahsay does not state that customer backup data was accessed, altered or deleted. ConnectWise says it has no evidence that its encrypted backup archives were accessed, although backups are not running and restoration remains unavailable while it investigates. Huntress notes that the effect on individual customer environments is not yet confirmed.

A successful backup report shows that a copy was made. It does not prove that the system managing it is secure, that access is appropriately limited, or that the data can be restored when needed.

What your IT provider should be able to explain

The sources describe the incidents. The expectations below are Amana’s own advice.

Protection. Who can administer the backup system, and how the platform is kept up to date.

Vulnerability handling. How quickly serious issues are assessed and addressed, and how you will be told if your service is affected.

Access into your systems. Which accounts or connections the service uses, what they can reach and how quickly that access could be switched off.

Detection. What is monitored, and what is checked after a serious vulnerability has been patched.

Unavailability. What happens if the backup service itself cannot be used. The NCSC advises smaller organisations to keep an online backup and a storage device that is not left connected when not in use.

What effective recovery testing should cover

The NCSC’s guidance for small organisations says to know how to restore a backup and to check that it contains all your important data.

For provider-managed backups, Amana would go further. Testing should involve restoring real data rather than relying on a completion report, with the time taken measured against how long the business could operate without that information.

There should be a record of who tested the recovery and when, and further testing after significant changes or after an incident affecting the backup platform.

Five questions to ask now

Your organisation should be able to answer:

1. How is the backup system protected?
2. How quickly are serious vulnerabilities addressed?
3. What can the provider reach in our systems?
4. How would we know if the backup environment had been compromised?
5. When did we last restore real data, and how long did it take?

Keeping it proportionate

Larger organisations might describe this as supplier assurance or third-party risk management.

In Amana’s view, a short conversation with the provider, a one-page written summary of the key arrangements and an annual review can be enough for many smaller organisations.

“Our IT provider handles it” should be the start of the conversation, not the end.

Sources: Ahsay, “Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134”, 12 October 2026, and “AhsayCBS Vulnerability Status Update”, 13 October 2026; Huntress, “Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer”, published 8 October 2026 and updated 12 October 2026; ConnectWise, “ConnectWise Cloud Backup Issue Investigation”, status updates of 16 and 17 October 2026; Huntress, “ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks”, published 16 October 2026 and updated 17 October 2026; NCSC, “Backing up your data”, Small organisations guide to cyber security, published 9 April 2026 and reviewed 21 July 2026.