BDRaaS Briefing: The Backup Server Is Privileged Access
Identity recovery was the vendor theme of the week. Dell says PowerProtect can now restore Active Directory, Entra ID and Okta, and Commvault set out where IDRecover goes next. Cohesity can now rebuild a cloud application from its Terraform code rather than from a snapshot of whatever the attacker left behind.
The rest of the week was about how much access a backup product holds. The US Department of Homeland Security has ordered Acronis out of federal civilian systems, citing the “privileged or root access” its tools have. Veeam patched an unauthenticated flaw in Backup & Replication 13. And Germany has passed its Cyber Resilience Act implementation law.
Vendor releases
Dell and Commvault both go after identity recovery
Dell’s new PowerProtect identity resilience capabilities, available now, restore a clean copy of Active Directory, Microsoft Entra ID and Okta, so access controls do not have to be rebuilt by hand after an incident. A PowerProtect AI assistant with daily risk briefs and an approval step for actions also ships now, StorageReview reports. Commvault announced cross-provider change auditing for the same three directories in IDRecover, plus discovery of Tier 0 identities. Those reach early access only “in the coming quarters”, with no GA date, according to iTWire.
The practical bit: Most clients have Okta or Entra alongside on-premises AD, and most backup scopes cover one of the three. If identity recovery is in your DR runbook, check which directories your tool restores today, not on the roadmap. Commvault’s new pieces are not something you can sell this quarter.
Cohesity rebuilds cloud applications from Terraform code
HashiCorp, now part of IBM, has validated Cohesity’s cloud rebuild as the first recovery method interoperable with Terraform Self-Managed. It backs up the Terraform code and the application data on separate schedules, recreates the declared infrastructure, then restores the nearest data backup and shows the time gap between the two. It is available now in Cohesity Data Cloud Enterprise Edition, with an upgrade route for DataProtect and NetBackup customers, Blocks & Files reports.
The practical bit: The argument is that restoring the approved code beats restoring a copy of production that may already contain the attacker’s changes. That holds only if the client’s infrastructure really is in Terraform. Ask before you put it in a proposal.
As a service
Hammer Distribution adds the Acronis portfolio in the UK
Hammer Distribution has signed a UK partnership with Acronis covering its security, infrastructure and MSP operations portfolio, including EDR, MDR, XDR, email security and DLP. Hammer’s partners already have access, ITPro reports.
The practical bit: Another UK route to Acronis means another price to compare at renewal. Ask both distributors for the same bundle quoted the same way.
11:11 Systems takes over IBM’s VMware cloud customers
11:11 Systems has acquired select enterprise customers of IBM’s VMware Cloud Service Provider business, across North America, EMEA, APAC and South America. Terms and customer numbers were not disclosed. It is 11:11’s eighth VMware-related transaction, ChannelLife reports.
The practical bit: Broadcom’s partner changes keep pushing VMware cloud customers towards fewer, larger providers. If a client’s DR target is a VMware cloud, find out who will be operating it next year and whether the contract survives a transfer.
Veeam reports on where backup copies actually sit
Veeam is making the case that sovereignty covers every backup, copy and replica, not just production. It points to placement policies that enforce residency per job, and a Data Sovereignty Violations report in Veeam ONE that flags any copy stored outside its required region. It is a marketing post, not a release, on Veeam’s blog.
The practical bit: Last week Veeam launched a sovereignty competency for providers. A report a client can file as audit evidence is the kind of thing that competency will expect you to produce. Run it on your own tenants before a client asks.
What is being exploited
Veeam patches an unauthenticated flaw in Backup & Replication 13
CVE-2026-108142, rated 9.1 under CVSS v4, is an authorisation bypass in the CDP Coordinator service that needs no credentials. It affects 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds, on Windows and the Veeam Software Appliance. Version 12 is not affected. Fixed builds are 13.1.2.57 and 13.0.3.63, under KB4948, and no exploitation has been reported, IT-Connect reports. The same round fixed four flaws in Veeam Backup for Microsoft 365, the worst rated critical, which could let an attacker read and write configuration data across tenants, SecurityWeek reports.
The practical bit: Not exploited yet, and Veeam itself warns that attackers study published patches to find unpatched servers. Patch the multi-tenant Microsoft 365 servers first, since a cross-tenant flaw on a provider’s server is the worst kind there is.
GMO Internet tells customers to back up and unplug
GMO Internet found malicious programs in some customer environments of its Onamae.com virtual desktop service on 20 October and suspended it the next day. An extortion demand of about 8 billion yen followed. Up to 26,739 servers may have been affected. Customers were told to back up their data, disconnect their PCs and power them off, Infosecurity Magazine reports.
The practical bit: The provider’s advice to its customers was to take a backup after the compromise. Check whether any client’s hosted desktops or VPS sit outside your backup scope because “the provider handles that”.
Regulation and compliance
DHS orders Acronis out of US federal civilian systems
Homeland Security has signed an exclusion and removal order under the Federal Acquisition Supply Chain Security Act. Federal civilian agencies may no longer buy from Acronis AG or its affiliates and have 180 days to remove its products. The order’s summary of risks says Acronis’s cyber and backup tools have “privileged or root access to customer security systems” and does not elaborate. It follows last year’s intelligence community ban. Acronis says the order “does not affect our customers and partners”, Federal News Network reports. The order gives no further technical detail about the risks, ExecutiveGov notes.
The practical bit: Nothing changes for a European MSP’s licences. The question will still arrive from a client who reads the headline, and some will hold US government contracts. Have an answer ready, and note that the stated reason, root access to protected systems, describes every backup agent you run.
Germany passes its Cyber Resilience Act law
The Bundestag adopted Germany’s CRA implementation act on 14 October and the Bundesrat did not object. The BSI becomes market surveillance authority, with fines of up to EUR 15 million or 2.5% of worldwide turnover, though fines only apply from 11 December 2027. Manufacturer reporting obligations have applied since 11 September 2026. Italy’s draft went to parliament on 9 October, according to law firm HLC.
The practical bit: The CRA lands on the makers of software and appliances, which includes your backup vendor. Ask each one how they meet the reporting duty that is already live, and how you will hear about an actively exploited flaw.
Also worth knowing
- Commvault’s second quarter revenue was $312.4 million, up 13%, with SaaS revenue of $106 million, up 33% (Blocks & Files).
- OVHcloud’s FY26 revenue was EUR 1,145.1 million, up 5.6%, and it has adjusted prices for rising RAM and storage costs (StorageNewsletter).
- In Hornetsecurity’s survey of 400 IT and security staff, about 3% of ransomware victims paid, and 45% are not confident in their protection strategy (Hornetsecurity).
- Veeam Data Platform now sends backup, restore and malware detection events to Arctic Wolf’s managed SOC (Veeam).
- Rubrik Code Guardian, which red-teams an air-gapped copy of a code repository, is in private preview (StorageNewsletter).
What to do this week
- Patch Veeam Backup for Microsoft 365 to its current build and Backup & Replication 13 to the KB4948 builds, multi-tenant servers first.
- List which of AD, Entra ID and Okta each client uses, and which your backup tool can actually restore.
- Write a short answer for clients who ask about the Acronis order, whatever you sell.
- Run a residency report across your backup copies and replicas, not just primary jobs.
