Skip to content
A SaaS supply chain attack skips your perimeter entirely. Instead of breaking into your network, attackers compromise a trusted third-party app, or the credentials that connect it, and ride that trust into your data. Backup platforms are a prime target because a SaaS backup vendor holds a standing, privileged credential into your environment. The fix is structural: keep backups in infrastructure you own, with no standing third-party credential, and make deletion impossible rather than just discouraged.
For years, security teams have focused on hardening their own perimeters. Organizations spent millions to stop direct attacks: next-generation firewalls that inspect encrypted traffic, endpoint tools like CrowdStrike and Microsoft Defender that flag malicious activity in real time, single sign-on through IAM providers like Okta and Microsoft Entra ID.
Recently, those defenses have started to matter less. The attackers changed strategy.
The number-one ransomware trend in 2026: you’re not getting hit directly
Attackers aren’t coming through the front door anymore. They’re compromising the SaaS platforms you never thought to distrust: a customer support portal, a ticketing system, a billing tool. These third-party apps are the new attack surface because one breach can hand an attacker access to hundreds, sometimes thousands, of organizations at once.
The Ernst & Young breach
In April 2026, Ernst & Young disclosed a breach that exposed sensitive client tax and financial records. The compromise came through a third-party IT support and ticketing platform, not EY’s core environment.
This wasn’t a sophisticated attack. It walked in through a support ticketing tool that one of the world’s largest professional services firms chose to trust. There’s a pot-and-kettle joke in here somewhere, given that EY advises other companies on exactly this kind of risk.
The SaaS platforms worth worrying about
Every SaaS app you run does more than hold data. It connects to other apps, exposes APIs, and carries privileged identities. Why spend months beating one enterprise’s defenses when you can compromise a tool that enterprises already trust? The return on effort is far higher.
Per Verizon’s 2025 Data Breach Investigations Report, third-party involvement in breaches doubled year over year, from 15% to 30%.
According to recent research, the platform types most at risk:
- CRM platforms
- Collaboration tools
- SaaS backup platforms
- HR systems
- Finance and billing tools
- Development platforms
- Customer support portals
- Identity providers
- Marketing automation
- File-sharing services
How it works: the Salesforce OAuth token thefts
Look at the Salesforce incidents. Starting around October 2025, a wave of breaches hit tools that integrate with Salesforce. Attackers weren’t targeting Salesforce itself. They went after the customer side, stealing OAuth tokens and API credentials that already had permission to reach Salesforce data.
That bypasses your perimeter completely. These integrations never see your password. It’s the “Allow this app to access your calendar” mechanism, which also means MFA never comes into play. With a stolen token, attackers connected straight to Salesforce instances.
By March 2026, ShinyHunters reportedly claimed 300 to 400 organizations were hit, roughly 100 of them high-profile. The companies named in those claims, reportedly including LastPass, Okta, AMD, and Snowflake, thought they were connecting trusted software.
The Hidden Problem With SaaS
Organizations treat trusted cloud apps differently from internal systems, and that’s what makes SaaS so attractive to attackers. Sensitive files pile up inside ticketing platforms. A few compounding habits make it worse:
- Admin access accumulates. People change roles and admins leave, but permissions don’t get revoked.
- OAuth grants are rarely reviewed, even for apps no one uses anymore.
- Unused integrations stay connected for years while teams keep adding new tools.
- Shadow SaaS spreads with no visibility. Employees adopt platforms on their own, no security review in sight.
- Support systems quietly become a store of screenshots, exports, diagnostic files, and customer records.
Recovery gets harder with a SaaS breach
Figuring out how you were compromised is only half the problem. Restoring data quickly is the other half, and SaaS breaches complicate it.
Traditional disaster recovery assumes your own infrastructure failed. You restore servers, databases, metadata, and network config, and you’re back online. Modern SaaS compromises break that assumption, because you’re not sure what was accessed or encrypted. The blast radius can include:
- Production environments
- Cloud storage
- Identity systems
- Backup repositories
- Recovery infrastructure
So you have to ask which apps and identities were compromised, along with the APIs, OAuth tokens, and connected apps behind them. Every trusted integration becomes its own investigation.
The Backup SaaS problem
Attackers increasingly go after SaaS backup products directly, to encrypt, lock, or steal the backups themselves. Two recent examples.
Commvault, Metallic M365 backup breach (2025)
A suspected nation-state actor exploited CVE-2025-3928, a zero-day in Commvault’s Web Server, to break into Commvault’s own Microsoft Azure environment. From there they reached client secrets tied to Commvault’s Metallic Microsoft 365 backup product, the app credentials used by certain Commvault customers’ deployments to authenticate to their M365 environments.
With those secrets, attackers could potentially reach the affected customer’s M365 environment by impersonating the backup app itself. CISA added the CVE to its Known Exploited Vulnerabilities catalog and said the activity might be part of a larger campaign targeting SaaS companies’ cloud applications with default configurations and elevated permissions.
EstateRansomware, Veeam CVE-2023-27532 (2024)
This group gained access through a dormant FortiGate SSL VPN account after observed brute-force attempts using a year-old flaw (CVE-2023-27532), even though the fix had been out since March 2023. The vulnerability potentially exposed encrypted credentials stored in Veeam’s configuration database, although Group-IB could not confirm that credential extraction succeeded in this incident.
The activity was followed by enabling xp_cmdshell and creating a rogue “VeeamBkp” account for persistent access. From there: AD reconnaissance, lateral movement, ransomware. Group-IB called it out specifically because it hit a vulnerability disclosed and fixed in supported releases more than a year earlier, a reminder that unpatched backup software stays a low-effort target long after a CVE goes public.
(You might want to check out a Veeam alternative that runs inside your account.)
The joint FBI/CISA and international-partner Akira advisory, updated November 13, 2025, says this isn’t a one-off. Akira, one of the most active ransomware operations, has been observed exploiting Veeam-related CVEs (CVE-2023-27532 and CVE-2024-40711). In some incidents, Akira exfiltrated data just over two hours after initial access. Exploitation of Veeam is recurring across multiple ransomware operations, rather than an isolated incident.
In both cases, the attacker didn’t stumble onto backups after breaching some unrelated system. The backup vendor’s own SaaS infrastructure was the target, and compromising it opened a path into every customer tenant it was trusted to protect.
See also: Ransomware backup strategies
The IaaS vs SaaS backup distinction
Here’s the structural difference. A SaaS backup product typically holds a standing, highly privileged credential into your tenant so it can pull data on schedule. If that vendor’s environment is breached, that trust relationship becomes the path into your data. An isolated, customer-controlled cloud account with no persistent third-party credential doesn’t create that shared blast radius.
See also: Secure backup options for AWS
Cyber-resilience with N2W
N2W’s IaaS model closes the gaps these SaaS breaches exposed, in four ways:
- N2W deploys inside your own AWS or Azure account rather than as a shared third-party SaaS platform. There’s no vendor-hosted backup infrastructure and no standing app credential for an attacker to compromise the way Commvault’s Metallic secrets were. You keep full ownership of the data, and no external company ever touches it.
- N2W is cloud-native so there’s no domain-joined backup server sitting on your network the way the Veeam box was in the EstateRansomware and Akira cases. That removes the lateral-movement target.
- Immutable backups for EBS, S3 Object Lock, Wasabi, and Azure Blob. You can also copy backups into an isolated DR account or subscription. For a true air gap, that copy can live in a different cloud entirely, so a compromise on one provider can’t reach it.
- Because it’s policy-enforced and automated from a single console across regions and subscriptions, recovery doesn’t depend on a shared multi-tenant platform going down for everyone at once.
Isolate the backup layer outside the blast radius, remove the standing trust relationship, and make deletion structurally impossible instead of policy-discouraged.
You can’t outsource the blame
The security conversation is changing. Defending your own infrastructure isn’t enough. The strongest firewall in the world can’t stop an attacker who walks in through a trusted SaaS integration with legitimate permissions.
Once you outsource a service, your risk profile goes up and you share the liability for it. This is a governance problem more than a technology one. Before you buy a SaaS service, especially for backup, can you answer these:
- How many SaaS platforms are connected to your environment?
- Which critical systems can each one reach?
- Which of your integrations have a breach history?
- Is your vendor transparent about where backups are stored, in which cloud, and what happens if they’re breached?
If you can’t answer those, your backup attack surface is almost certainly bigger than you think.
Simplify your backup strategy and strengthen resilience with N2W’s IaaS data protection platform. See how N2W helps protect your cloud workloads from ransomware and SaaS threats.
FAQ
What is a SaaS supply chain attack?
An attack that reaches your data by compromising a trusted third-party SaaS app or its credentials, instead of breaking into your own network. Because the app already has legitimate access, the attacker inherits that access without touching your perimeter or triggering MFA.
Why are SaaS backup platforms a target?
A SaaS backup product holds a standing, highly privileged credential into your environment so it can pull data on a schedule. If the vendor’s own infrastructure is breached, that trust relationship becomes a direct path into every customer tenant it backs up.
How is IaaS backup different from SaaS backup?
An IaaS backup platform like N2W runs inside your own cloud account rather than the vendor’s. There’s no vendor-hosted infrastructure and no persistent third-party credential to steal, so a breach of the vendor doesn’t create a shared blast radius across customers.
If a backup vendor keeps copies in a separate account, is that an air gap?
Only partly. A separate account or subscription in the same cloud is logical isolation. It still shares one provider and control plane, and if the vendor’s trust relationship into your tenant is compromised, that copy is reachable. A true air gap puts the copy in a different cloud entirely.
What next? Check out our guide to Ransomware Protection