Skip to content
For years, cybersecurity teams have focused on hardening their own perimeters. These organizations have invested millions to prevent direct attacks with things like smart, Next-Generation Firewalls (NGFWs) capable of inspecting encrypted traffic and identifying malicious behavior. Platforms like CrowdStrike and Microsoft Defender were big sellers due to their ability to detect malicious activity on endpoints in real time. Single Sign on became ubiquitous as orgs invested in Identity and Access Management (IAM) providers like Okta and Microsoft Entra ID.
But very recently, we’ve come to realize that these defenses aren’t working anymore. The reason is because attackers have changed their strategy.
The Number One Ransomware Trend in 2026: Organizations are not getting hit directly
Instead of attacking organizations directly, malicious attacks and infiltrations are targeting SaaS platforms. These are software integrations that organizations never thought to distrust. This could mean a customer support portal, a ticketing platform, even a third party billing platform. These third-party applications have become the new attack surface because one breach can deliver a hacker access to hundreds, or even thousands, of organizations simultaneously.
The Recent Ernst & Young Breach
A very recent example of this is Ernst & Young, an enormous professional services organization that is relied on for cyber incident prevention. In April 2026, they disclosed a data breach exposing sensitive client tax and financial records. The compromise occurred via a third-party IT support platform rather than EY’s core enterprise environment.
This wasn’t a sophisticated attack by any means. It was through a third-party support ticketing platform that one of the world’s largest professional services firm chose to trust. This, afterall, is a company that advises organizations on digital transformation and risk management. Insert a joke here about pot calling the kettle black.
SaaS Platforms to Be Wary Of
Attackers understand that each SaaS application you use not only contains data, it connects to other applications, has APIs, privileged identities and an additional attack surface. Why spend months trying to bypass one single enterprise’s defense, if they can compromise applications already trusted by those organizations?
The result is dramatically higher return on investment. According to Verizon’s 2026 Data Breach Investigations Repor, breaches involving third parties have risen significantly, increasing 60% year over year and now accounting for 48% of all breaches.
These are just some of types of SaaS platforms that, according to recent research reports, are at risk.
- CRM platforms
- Collaboration tools
- SaaS backup platforms
- HR systems
- Finance applications and billing tools
- Development platforms
- Customer support portals
- Identity providers
- Marketing automation
- File sharing services
How it works: The Salesforce Breach using Stolen OAuth Tokens
Take the case of the recent Salesforce incident. Back in October 2025, there was a wave of breaches with third-party tools that integrated with Salesforce. Malicious actors weren’t targeting Salesforce, in this case they were not the weak link. Instead, attackers targeted weaknesses on the customer side by stealing OAuth tokens and API credentials that had permission to access Salesforce data. These is essentially bypassing any perimeter of your data, getting access because these apps never see your password. It’s an “Allow this app to access your Calendar” mechanism, and it meant that MFA was bypassed and attackers successfully connected to Salesforce instances.
By March 2026, ShinyHunters claimed 300 – 400 organizations were hit, roughly 100 of them high-profile. The security teams on these companies such as (Pandora, Qantas, Cisco, Disney/Hulu, FedEx, IKEA, Marriott, etc) thought these were trusted software integrations.
The Hidden Problem With SaaS
SaaS has become so attractive to attackers ibecause organizations often treat trusted cloud applications differently than internal systems. Hackers can easily get access to sensitive files end up inside ticketing platforms. There a number of compounding mistakes that companies make that worsen the problem:
- Admin access accumulates over time. Employees change roles and admins leave but permissions don’t change.
- OAuth permissions are rarely reviewed, even when the application is no longer used.
- Unused integrations remain connected for years while enterprises keep adopting more tools and integrations.
- Shadow SaaS proliferates without visibility. Employees adopt platforms on their own to help with productivity without any security review processes in place.
- SaaS platforms such as support systems become a repository for screenshots, exports, diagnostic files and other customer records.
Recovery Becomes More Complicated with SaaS Breaches
When the security team understands how and from they have been compromised, a whole other set of challenges arise when it’s time to restore data in a timely manner.
Traditional disaster recovery assumes that our own infrastructure has failed, so we restore our servers and databases, along with the metadata and network configurations and hope we’ don’t’re back online fast.
But modern SaaS compromises mean that you aren’t just recoverying your data because you aren’t really sure what’s been accessed and what’s been encrypted. This could be:
- Production environments
- Cloud storage
- Identity systems
- Backup repositories
- Recovery infrastructure
That means you have to ask yourself which applications and identities were compromised, along with APIs, OAuth tokens and other connected applications. Every trusted integration becomes another investigation.
The Backup SaaS Problem
There are many examples of malicious actors targeting SaaS backup products in order to infiltrate backup systems and inevitably encrypt, lock or steal backup data. Two recent examples:
Commvault — Metallic M365 backup breach (2025). A nation-state actor exploited CVE-2025-3928, a zero-day in Commvault’s Web Server, to break into Commvault’s own Microsoft Azure environment. From there they accessed client secrets tied to Commvault’s Metallic Microsoft 365 backup product — the credentials Commvault uses to authenticate into customers’ M365 tenants to perform backups. With those secrets, attackers could potentially reach into any customer’s M365 environment (email, SharePoint, OneDrive) by impersonating the backup app itself. CISA added it to the Known Exploited Vulnerabilities catalog and flagged it as part of a broader campaign hitting SaaS providers with overly-permissioned cloud app configurations.
EstateRansomware — Veeam CVE-2023-27532 (April 2024). This group broke in through brute-forcing a Fortinet FortiGate SSL VPN, then pivoted straight to the Veeam Backup & Replication server using a year-old, previously-patched flaw (CVE-2023-27532), even though the patch had been available since March 2023. The exploit let them extract the encrypted credentials stored in Veeam’s configuration database, and create a rogue account named “VeeamBkp” for persistent access to the backup infrastructure. From there they ran AD reconnaissance and lateral movement before deploying ransomware. Group-IB flagged this as notable specifically because it targeted a vulnerability the industry considered “old news” — a reminder that unpatched backup software is a durable, low-effort target long after a CVE is public.
It’s worth noting that CISA’s most recent Akira advisory (updated November 2025) confirms this is not an isolated case. Akira, one of the most active ransomware operations, has now added six Veeam-related CVEs (including this same CVE-2023-27532 and CVE-2024-40711) to its standard toolkit, and has been observed exfiltrating data from Veeam servers in as little as two hours once inside. That tells you Veeam-targeting isn’t opportunistic anymore, it’s a documented, repeatable step in multiple ransomware groups’ playbooks.
In both of these cases, it’s not an attacker reaching backups after compromising some unrelated system. The backup vendor’s own SaaS infrastructure was the initial target, and compromising it gave a path into every customer tenant it was trusted to back up.
IaaS vs SaaS backup Distinction
These examples underscore a specific IaaS-vs-SaaS-backup distinction: a SaaS backup product typically holds a standing, highly-privileged credential into your tenant so it can pull data on schedule. If that vendor’s environment is breached, that trust relationship becomes the attack path into your data, whereas an isolated, customer-controlled cloud account with no persistent third-party credential doesn’t create that shared blast radius.
The Future of Cyber-resilience using N2W
N2W’s IaaS model addresses exactly the gaps exposed across SaaS infiltrations in four ways:
- Because N2W deploys inside your own AWS/Azure account rather than as a shared third-party SaaS platform, there’s no vendor-hosted backup infrastructure or standing app credential for an attacker to compromise the way Commvault’s Metallic secrets or Rubrik’s environment were hit. You keep full ownership of the data and no external company ever touches it.
- N2W is agentless and cloud-native, so there’s no domain-joined backup server sitting on your network the way the Veeam box was in the EstateRansomware and Qilin cases, removing that lateral-movement target entirely.
- Backups can be made immutable (EBS snapshot lock, S3 Object Lock, Wasabi Compliance Locking) and stored in air-gapped DR accounts outside your Azure subscription, AWS account, or even be isolated cross-cloud.
- Because it’s policy-enforced and automated from a single console across regions and subscriptions, recovery doesn’t depend on a shared multi-tenant platform going down for everyone at once.
In short: isolate the backup layer outside the blast radius, remove the standing trust relationship, and make deletion structurally impossible rather than just policy-discouraged.
No Room To Blame On your Vendor.
The security conversation is changing. Organizations no longer defend only their infrastructure. The strongest firewall in the world cannot stop an attacker who walks through a trusted SaaS integration with legitimate permissions.
The reality is that once you decide to outsource a service, your risk profile goes up and you must share the liability of having that additional risk. At the end of the day, this is a governance issue, rather than a technology problem. We we buy SaaS services, particularly for your backup processes, are you able to confidently answer the following:
- How many SaaS platforms much I spin up to be connected to our environment?
- Which critical systems are being accessed?
- Which integrations have a history of security breaches?
- Is my vendor transparent with backup storage location, cloud and what happens if there is a breach on their end?
If you can’t answer those questions, your attack surface for your backups is almost certainly larger than you think.
Simplify your backup strategy and strengthen resilience with N2W’s IaaS data protection platform. Adopt cyber-resilient best practices and see how N2W helps protect your cloud workloads from ransomware and SaaS threats.