Most small business owners think of a backup as the thing that saves you after ransomware hits. Lock up my files, fine — I’ll restore from yesterday’s backup and move on. That logic is getting harder to rely on, and this week’s headlines explain why.
Security vendor Kaseya put out research noting that ransomware groups are increasingly targeting backup infrastructure itself before they ever trigger the encryption that locks up your files. The idea is simple and unsettling: if an attacker can find and disable or corrupt your backups first, your recovery option disappears, and the pressure to pay goes way up. The practical takeaway isn’t complicated, even if the solution takes some work — backups that live on the same network as everything else, with no separation and no protection against being altered, aren’t doing the job people assume they’re doing. ’Isolated’ and ’immutable’ (meaning a copy that can’t be changed or deleted, even by someone with admin access) are the terms worth asking your IT provider or managed security partner about.
The second theme this week is speed. A critical flaw in Atlassian’s Data Center products had attackers probing for it within two hours of the technical details becoming public. Separately, the FBI and Secret Service issued a fresh warning that a credential-harvesting campaign against Fortinet devices — nicknamed FortiBleed — is still active, with more than 86,000 device credentials already collected. And Citrix had to patch its third actively-exploited zero-day (a vulnerability attackers found and used before a fix existed) in a matter of days. None of this means you need to personally track every vendor’s patch schedule. It does mean the old assumption — ’we’ll get to that update sometime this month’ — doesn’t match how fast attackers are moving anymore. If your business runs on vendor software (and whose doesn’t), knowing how quickly your provider applies security updates is a fair question to ask them.
There’s some good news buried in here too. Law enforcement had a genuinely strong week. A teenager suspected of leading the ShinyHunters data-theft group was detained and is reportedly cooperating with the FBI, and a suspect connected to Qilin ransomware was arrested in Japan and extradited to Germany to face charges. These groups don’t operate alone, and arrests like these tend to disrupt operations even when they don’t end them outright. It’s a useful reminder that this fight isn’t one-sided, even on weeks that feel otherwise.
Finally, a note for anyone in healthcare or adjacent to it: an industry analysis found that many medical devices currently in use can’t support the newer encryption standards designed to resist future quantum computing attacks (so-called post-quantum cryptography). This isn’t an urgent fire to put out today, but it’s the kind of long-lead-time issue worth flagging to your IT or compliance team now, especially if your organization has a multi-year device refresh cycle.
Nothing here requires a dramatic response. But if you’re reviewing your backup setup, your patch process, or just want a second opinion on where your business stands, that’s what we’re here for.