BDRaaS Briefing: When the Provider Is the Incident
Veeam shipped the 13.1 versions of Recovery Orchestrator and its file and NAS backup this week, and both remove a piece of infrastructure you used to need. Acronis added Proxmox 9.1 and 9.2 to Cyber Protect. Arcserve bundled its ransomware tooling into two suites, one of which comes with a named incident commander.
The rest of the week was about providers. OVHcloud opened a SecNumCloud-qualified public cloud, 11:11 Systems took on a book of IBM’s VMware cloud customers, and a Japanese IaaS platform serving 495 companies and local governments was taken down by ransomware. The attacker claims to have wiped more than half a million snapshots.
Vendor releases
Veeam 13.1 fills in Hyper-V and archive gaps
Veeam Recovery Orchestrator 13.1, part of Veeam Data Platform Premium, can now recover to a stand-alone Hyper-V host. Until now Hyper-V recovery needed a cluster. Hyper-V backups can also be restored straight to Azure through Cloud Plans, and object storage repositories can be attached read-only so clean-room plans see the latest restore points.
Separately, Backup & Replication 13.1 lets file, object and NAS jobs write directly to the S3 Glacier storage class, or Azure Archive, with no scale-out repository or Capacity Tier in front. The wizard warns when retention is shorter than the class minimum. Veeam’s own example is a 28-day retention against a 180-day minimum, which bills for the full 180.
The practical bit. Stand-alone Hyper-V recovery makes Orchestrator usable for the small Hyper-V estates many clients are moving to from VMware. On Glacier, check retention against the class minimum on every job, and price restores at Bulk retrieval times, not Expedited.
Acronis Cyber Protect v17 adds Proxmox 9.1 and 9.2
The Q3 2026 release of Cyber Protect v17 supports Proxmox 9.1 to 9.2 and Nutanix 7.3 to 7.5. Entra ID backup now covers user, group and role settings, custom domains and organisation settings, and VM backup archive passwords can be rotated without recreating jobs. Acronis has also added an anti-ransomware warranty that it says puts a financial guarantee behind qualifying recovery points. No amount is published.
The practical bit. Proxmox support has lagged Proxmox releases across most backup tools, so this is the line to check if a client is on 9.x. Read the warranty terms before mentioning it to anyone. A guarantee with undisclosed limits is not something to resell.
Source: Acronis
Arcserve bundles its ransomware tooling into Core and Pro suites
Arcserve launched two subscription suites on 5 October. Core watches backup data for mass encryption and bulk deletion, adds offsite immutable cloud storage sold in 1 TB increments, and runs automated recovery tests against RPO and RTO targets. Pro adds DR runbooks and Arcserve’s Rapid Ransomware Response service, in which a named incident commander takes the case within 30 minutes, around the clock. Both are available now through distributors and resellers. No prices.
The practical bit. For a managed client, the MSP is supposed to be the incident commander. If you resell Pro, decide who owns the incident before the client finds out there are two answers.
Source: Arcserve
Nutanix AHV will run on existing NetApp arrays
Nutanix Cloud Infrastructure for External Storage lets AHV run on existing NetApp AFF and FAS arrays over NFS, with VMs managed in Prism and storage still in ONTAP. It is expected in a Nutanix release “in the coming months”.
The practical bit. This takes the array refresh out of a VMware exit. Nothing has been said yet about snapshots, replication or how AHV on ONTAP is backed up. Confirm your backup product supports the combination before you quote the migration.
Source: ChannelLife
As a service
OVHcloud opens a SecNumCloud-qualified public cloud
OVHcloud’s SNC Cloud Platform has been qualified under SecNumCloud by ANSSI, its third qualified environment. It offers virtual machines, block storage, S3-compatible object storage and private networking on usage-based billing. Gravelines is available now, Strasbourg follows in early November and Roubaix in January, with Italy, Germany and Poland named as the next national deployments.
The practical bit. Backup is not on the service list, but S3-compatible object storage is a backup target. For French public sector clients and their suppliers, a SecNumCloud-qualified repository is now something you can buy by the gigabyte rather than build.
Source: OVHcloud
11:11 Systems takes over IBM’s VMware cloud customers
11:11 Systems has acquired a selection of IBM’s VMware Cloud Service Provider enterprise customers, its eighth VMware-related deal. Terms and customer numbers were not disclosed. Broadcom endorsed it as part of concentrating its cloud ecosystem on fewer, larger providers. 11:11 plans to migrate the customers onto its own platform and sell them backup, DR, networking and security. Its CEO, Brett Diamond, told Channel Insider: “We do not really support other hypervisors.”
The practical bit. If you run DRaaS on VMware, Broadcom has signalled which providers it wants left standing. Any client whose DR target sits with a smaller VCSP needs a written answer to what happens if that provider’s contract changes.
Source: Channel Insider
What is being exploited
Ransomware takes down Japan’s IDCF Cloud
IDC Frontier, a SoftBank Group company, says its IDCF Cloud East Japan Region 1 was disrupted by ransomware from 03:40 local time on 7 October. BleepingComputer reports 495 companies and local governments affected. Console access has been disabled in every region while the others are checked, and there is no restoration date. The attacker claims to have reached 239 hypervisors and wiped 554,153 snapshots. None of that is confirmed.
The practical bit. If the snapshot claim holds, every customer relying on the provider’s own snapshots lost them along with production. Snapshots inside the same platform and admin plane are not a backup. For every client on IaaS, find out where the copy you would restore from sits, and whose credentials can delete it.
Source: BleepingComputer
MonsterCloud owner charged over secret ransom payments
US prosecutors have charged Zohar Pinhasi, owner of Florida ransomware remediation firm MonsterCloud, with wire fraud. They allege that from 2018 to 2023 the firm claimed proprietary decryption, then paid attackers for keys: more than $8 million in ransoms, against more than $19 million billed to hundreds of companies in the US and Canada. He has pleaded not guilty.
The practical bit. A ransom paid by a recovery firm is still a ransom paid on the client’s behalf. If a client’s insurer or incident retainer names a recovery firm, ask how it decrypts and get the answer in writing.
Source: BleepingComputer
Regulation and compliance
UK Supreme Court hears whether data claims need a seriousness threshold
The Supreme Court heard Farley v Paymaster (1836), which trades as Equiniti, on 7 and 8 October. More than 400 current and former Sussex Police officers are claiming after pension statements went to old addresses. The Court of Appeal held that no threshold of seriousness applies to UK GDPR compensation claims, and Equiniti wants that overturned. The Information Commission, the renamed ICO, has intervened against a threshold.
The practical bit. If the Court of Appeal ruling stands, a misdirected letter or a restore to the wrong place can support a mass claim without proof of misuse. Look at the liability caps in your own contracts for data-handling errors.
Source: Computer Weekly
Also worth knowing
- Virtuozzo relaunched its partner programme as V/Partner, with a service provider track and built-in multi-tenancy pitched as a VMware alternative. (VMblog)
- Japan handed a 28-year-old Russian alleged to be a core Qilin member to Germany on 2 October. He is wanted over a September 2024 attack on a logistics company. (SecurityWeek)
- Backblaze’s Q2 2026 Drive Stats put the quarterly annualised failure rate at 1.73%, up from 1.24% in Q1, across more than 350,000 drives. (StorageNewsletter)
- Auvik’s network management will be built natively into Acronis RMM under an OEM deal. (VMblog)
What to do this week
- Check where each IaaS client’s restorable copy lives. Provider snapshots under the same admin plane do not count.
- Audit archive-tier retention against storage class minimums before moving any Veeam 13.1 file or NAS jobs to Glacier.
- Ask the recovery firm on each client’s insurance or retainer how it decrypts. Get it in writing.
- Confirm backup support for any VMware exit target, Proxmox 9.x or AHV on ONTAP, before quoting the migration.
Backuptron’s weekly brief on backup and disaster recovery delivered as a service, read from Europe.
