Most businesses assume that if their data is backed up, they’re protected. But there’s an important catch: if someone who gains access to your system can also access and delete those backups, they may not protect you at all.
That’s exactly what happened in a recent attack involving a group called JADEPUFFER1. They gained access to Microsoft Azure cloud accounts and erased both the businesses’ data and their backups. They didn’t need two separate attacks or some extraordinary technical trick. The account they compromised had permission to access both. Once they were in, they had everything they needed to do serious damage.
For a small or midsize business, that’s the part worth paying attention to. Having backups is only one piece of the equation. Where those backups are kept, who can access them, and whether they can be altered or deleted from the same account matter just as much.
Below, we’ll look at what this attack exposed and some practical ways to make sure one compromised account can’t take your primary data and your backup plan down with it.
The problem with putting all your eggs in one basket
One of the biggest takeaways from the JADEPUFFER attack is how much damage came from access to just one account. The attackers compromised what’s called a “service principal.” In simple terms, it’s an account that software uses to handle automated tasks in the background. Because no one is regularly logging into it like a normal user account, it can be easy to overlook.
The problem was how much that one account was allowed to do. It could access the company’s data, but it could also access the backups. Once the attackers had control of it, they were able to delete both.
That’s where the real vulnerability was. If one account has the keys to your primary data and to the thing you’re relying on to recover it, you don’t really have two layers of protection. You have one. A backup only gives you a safety net when it’s protected from whatever takes down the original.
Why big, all-in-one systems can work against you
Many businesses run their operations within a single large system where everything connects to everything else. It feels efficient. One login, one platform, one place to manage it all.
The trouble is that convenience cuts both ways. When one system holds your files, customer data, email, and backups, a single break-in reaches all of it. No wall separates the pieces. A bad day becomes a catastrophe because nothing was kept separate.
We’re not saying big platforms are the enemy. The point is that the way you arrange access within those platforms determines how much damage any single mistake can cause.
AI has changed who can pull off an attack
One more detail makes the JADEPUFFER case stand out: it’s been documented as the first ransomware operation to use AI to carry out its attacks.
That matters because AI lowers the skill and time an attacker needs. Tasks that once took an experienced hacker hours can now be handled faster and at a larger scale. For a small business, the takeaway isn’t panic. It’s that basics matter more than ever, because attacks are getting cheaper and more common, not rarer.
What you can actually do about it
No system is completely immune to something going wrong. What matters is what happens next and whether you can recover without losing everything in the process. The weaknesses this attack exposed, like backups too easy to access, accounts with more permissions than required, and systems not properly separated, are all things that can be addressed. And you don’t need an enterprise-sized budget to do it. You need to be intentional about how things are set up in the first place. That’s something Questa Volta spends a lot of time helping our clients think through.
Keep a backup that lives somewhere else with credentials that have nothing to do with your main system. If the account that runs your primary environment can also reach and delete your backups, those backups offer no real protection. A resilient backup lives on separate infrastructure, accessed through its own separate credentials, so a compromised account in your main system has no path to it. We set up offsite copies structured exactly this way, so your recovery option stays intact even when your primary environment is not.
Give every account only the access it needs. Least-privilege access is one of the most effective resilience measures a small business can put in place. It’s also one of the most overlooked.
- A bot that processes orders doesn’t need permission to delete your entire database.
- A staff login for your billing system doesn’t need access to your server environment.
We map out who and what can touch your systems, then trim those permissions down to exactly what each role requires. The smaller each account’s reach, the smaller the damage if that account is ever compromised.
Don’t let one account become the master key. Spread critical functions across separate accounts and, where it makes sense, separate services. If one is compromised, the damage remains contained rather than spreading everywhere.
Watch the automated accounts and have a recovery plan when something gets through. The bot accounts running quietly in the background deserve the same scrutiny as your staff logins. We help you find them, document what they do, and lock down the ones carrying more access than they need. But access controls alone are not enough. Every small business should have a written recovery plan that answers a few basic questions, such as: What do we do if a key account is compromised? Who gets called first? Where is the clean backup, and how do we restore from it? That plan doesn’t need to be long. It needs to exist before something goes wrong, not after.
How we can help
We work with small and midsize businesses to look at these risks one at a time, in plain language, without the fear tactics. We start by mapping what you have, who can access it, and where your backups actually live. From there, we build in the separation and redundancy that keeps a single break-in from becoming a total loss.
Want to know how your setup would hold up? Reach out to Questa Volta for a straightforward review. We’ll show you where you stand and what to fix first.
Source
- Ravie Lakshmanan, “JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources,” The Hacker News, September 28, 2026.
↩︎
