Soft ComputersLast week, BleepingComputer reported that hackers pulled off a $133 million heist against a French bank. They didn't break through the bank's own perimeter. They went through a service provider the bank trusted.
That detail is the whole story. The bank had its own defenses. Its vendor didn't hold up to the same standard, and the attackers walked in through that door instead.
We work with Canadian SMBs every day who have this exact problem and don't know it. They've put real effort into their own systems. Firewalls, antivirus, password policies. But when we ask them what happens if one of their vendors gets hit, the answer is usually silence.
Your Backups Are Only as Good as Your Recovery Plan
Most small and mid-sized businesses in Canada use at least a handful of third-party platforms to run their operations. Accounting software, payroll processors, cloud storage, project management tools, CRMs. Each of those vendors holds some slice of your business data.
Here's the problem. If that vendor gets breached or goes offline, your backup of your own systems won't help you recover what lived in theirs. And if you haven't tested whether you can actually operate without that platform for 48 or 72 hours, you don't know how bad that disruption would be.
The French bank breach is a good forcing function. Ask yourself these questions about every critical vendor you rely on.
- Do you export and store your own copy of data held by that vendor? Most SaaS platforms let you do this. Most businesses never bother.
- Do you know what your vendor's recovery time objective is? If they go down, how long before they're back up? Have you seen that in writing?
- Have you asked your vendor about their backup practices? Where is your data stored? How often is it backed up? What is their tested recovery process?
- What is your fallback if that vendor is unavailable for a full business week? Could you operate on paper or spreadsheets temporarily? Could you switch platforms? Do you even have the data you'd need to do that?
The 3-2-1 Rule Still Applies to Vendor Data
The standard backup rule is three copies of your data, on two different media types, with one copy stored offsite. That logic applies to data your vendors hold on your behalf too, not just data sitting on your own servers or workstations.
For a small business, this doesn't have to be complicated. If your accounting data lives in QuickBooks Online, schedule a monthly export of your full company file and store it in a separate, encrypted location, something that isn't connected to your QuickBooks account. If your CRM is HubSpot, use their export tools to pull a full contact and deal history backup on a regular schedule. If your files live in Microsoft SharePoint or Google Drive, make sure you have a third-party backup tool running against those environments, not just the built-in versioning that Microsoft and Google provide. Those built-in tools are not the same as a real backup.
We use and recommend tools like Veeam, Datto, and Acronis for clients depending on the size and complexity of their environment. Each of these can reach into Microsoft 365 or Google Workspace and pull a true backup that you control, independent of the cloud vendor.
Test the Recovery, Not Just the Backup
Running backups is half the job. The other half is confirming you can actually restore from them. We talk to businesses that have been running backups for years and have never once done a test restore. When a real incident hits, they find out for the first time that the backups were failing silently, or the restore process takes three times longer than expected, or the recovered data is missing the last six months.
We recommend a documented recovery test at minimum once per quarter. That means actually restoring a system or a dataset to a test environment and confirming everything works. It doesn't need to be your whole environment every time. Rotating through your critical systems over the course of a year is a reasonable approach for most SMBs.
What We Recommend Right Now
The French bank didn't lose $133 million because it had bad security. It lost that money because its vendor was a weak link that attackers knew how to find. The lesson for Canadian SMBs is not to panic. It's to be specific and honest about where your gaps actually are.
Start with a list of every third-party platform that touches your business data. For each one, confirm whether you have an independent backup you control, and whether you've tested restoring from it. If you haven't done that work, that's the gap to close.
If you want a hand doing that audit or setting up automated offsite backups for your cloud platforms, reach out to our team. This is exactly the kind of work we do for Canadian SMBs, and it's usually faster and less expensive to fix than most owners expect.