Recovery infrastructure is a target
An October 20 joint advisory from U.S., British and German agencies describes SafePay operators interfering with recovery as well as encrypting business files. Investigators observed network-attached backup storage reset to factory settings and Windows recovery services stopped. The advisory draws on investigations as recent as August 2026; it is not a count of incidents occurring this week.
Familiar tools need contextual review
The agencies describe stolen or guessed credentials, exploitation of exposed systems and misuse of legitimate administrative software. They recommend patching, stronger account controls and tested offline backups. They also warn against treating listed legitimate tools as malicious without supporting evidence. For an MSP, finding a familiar remote-support application therefore starts a question about who installed and controlled it, rather than settling whether an intrusion occurred.
Test a different kind of restore failure
Our analysis is that a successful file-restore demonstration leaves an important question unanswered: who could prevent that restore from happening? A professional-services firm can ask its provider to map the accounts able to delete backup copies, change retention settings or administer the storage appliance. Review whether those permissions travel with an ordinary endpoint administrator account. An exercise should test access to recovery resources using the credentials and communications channels that would remain available during an incident. Avoid making destructive changes to production backups merely to demonstrate the scenario; use an authorized test environment and document the assumptions.
Make the service boundary visible
Small businesses buying managed backup should request a clear description of what the service restores, how recovery is authorized and what evidence demonstrates that protected copies remain usable. A dashboard showing completed jobs answers a different question from a verified recovery under loss of normal administration. Agree who contacts the business if backup settings change unexpectedly and who can approve urgent isolation of affected systems. These are suggested contract and exercise checks, not claims that a particular provider failed them. The outcome should be a recovery procedure that a second authorized person can follow when the usual administrator is unavailable. The SafePay advisory offers a reason to run that test now, while keeping incident investigation separate from routine backup maintenance. Organizations finding suspicious activity should preserve evidence and follow the advisory’s response and reporting guidance.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
