A cloud outage and a supplier breach demand different proof of recovery
ActiveCloud’s ransomware disruption and Baker Tilly’s supplier-linked exposure show why operational restoration and data-risk resolution cannot be managed as the same incident.
By Calder Rowe · disclosed fictional OMIKINA AI editorial persona · No human review recorded
Published
AI-persona disclosure
Fictional OMIKINA AI editorial persona; not a human reporter and does not possess a human career history, credentials, or firsthand experience.
Key points
- ActiveCloud reported that ransomware encrypted parts of its cloud infrastructure, interrupting hosting, email, virtual-server and support services before its main services were restored.
Sources: S1
- Baker Tilly is notifying clients after personal information, including Social Security numbers, was taken from a service provider’s platform; filings indicate more than 10,000 Texas victims.
Sources: S2
- The comparison points to two distinct recovery tests: whether customers can reliably operate again, and whether affected people have been identified and protected after data leaves a supplier environment.
Availability is not the same as containment
The ActiveCloud ransomware incident is foremost an availability crisis. The Belarusian cloud provider said attackers breached its systems and encrypted parts of its infrastructure, leaving customers unable to use cloud-hosting platforms, corporate email, virtual servers and customer-support channels. Its affected offerings included E-Cloud, E-Cloud Protected and SmartMail. The company later said it had restored its main services, while warning that individual customers could still face problems restoring virtual machines.
Sources: S1
The operational consequences reach beyond the provider’s own systems. Smartpress confirmed that its website ran on ActiveCloud infrastructure, and local reports linked temporary disruption of Domino’s Pizza’s Belarus website and mobile application to technical problems. The supplied record does not establish the full number of affected customers, the precise initial access path, or the identity of the attackers. ActiveCloud said it found no evidence of customer-data theft, but that is a statement about the company’s investigation rather than proof that every customer impact has been ruled out.
Sources: S1
Baker Tilly presents the inverse emphasis. The accounting firm is informing clients that hackers took personal information, including Social Security numbers, from a platform operated by one of its service providers. The incident dates to early September and includes clients’ dependents, including children. Baker Tilly had not named the vendor or disclosed the total affected population in the supplied report, although state regulator filings point to more than 10,000 victims in Texas alone. This is a disclosure and downstream-harm problem even if Baker Tilly’s own client-facing systems remain available.
Sources: S2
The shared dependency is supplier control, but the evidence needed differs
Both events put an intermediary between an organization and the people depending on it. ActiveCloud supplies hosting, virtual servers, corporate email and other infrastructure to businesses and organizations in Belarus and Russia. Baker Tilly’s reported exposure arose on a service provider’s platform. In each case, a customer’s risk is shaped by systems it does not directly operate. But a shared dependency does not make the incidents interchangeable: ActiveCloud customers need functioning workloads, while Baker Tilly clients and dependents need clarity about data handling and exposure.
Inference: these cases support a two-track incident model. A service-restoration track should test whether workloads, email, support access and virtual machines actually work for affected customers, rather than treating a provider’s statement that main services are restored as the final condition. A data-exposure track should establish what information was taken, who is affected, which supplier handled it, and what protections follow. The inference does not assume that either organization failed to take a particular step; it identifies the different proof required by the harms reported.
That distinction also matters for communications. ActiveCloud’s account contains a service status: most services were operational, but some virtual-machine restoration issues could remain. Baker Tilly’s reported notice concerns the theft of sensitive personal information, while important scope questions remain open in the supplied material, including the vendor’s identity and the total number of people affected. A generic assurance that an incident is contained cannot answer both a customer trying to recover a system and a person deciding how to respond to a Social Security number exposure.
What delivery looks like after the announcement
For ActiveCloud, delivered recovery would be customer-level evidence that the remaining virtual-machine problems are resolved, not simply that core infrastructure has returned. The provider’s experience also underlines the importance of recoverability. In a separate Russian hosting incident described in the same report, Beget said attackers wiped data from parts of its cloud environment and that some virtual-server backups were lost, forcing reconstruction of parts of its infrastructure. There is no publicly confirmed evidence linking the ActiveCloud, ESTT and Beget attacks, so the Russian cases should be treated as context, not attribution.
Sources: S1
For Baker Tilly, delivered response would mean more complete information about the supplier incident’s scope and affected population, alongside measures that address the risks from stolen personal data. The supplied reporting confirms notification activity and identifies data types, but does not provide details of the vendor, the attack path, the total number affected, or remedies offered to those notified. Those omissions in the material do not show that Baker Tilly has not determined or communicated such details elsewhere; they mark the current limits of this record.
Sources: S2
The practical decision for organizations buying critical cloud or data-processing services is to separate continuity requirements from exposure-response requirements before an incident. Continuity planning concerns restoration authority, backup integrity, workload validation and alternate ways to communicate when provider support channels fail. Exposure planning concerns supplier notification duties, data inventories, affected-person identification and a way to give customers usable information. The events show why a single vendor-risk questionnaire or a single crisis dashboard may not supply both forms of assurance.
What could change the assessment
The central uncertainty is not whether disruption or exposure occurred; both are reported. It is whether the residual risks are shrinking in a demonstrable way. For ActiveCloud, evidence that all affected virtual machines have been restored, an explanation of the intrusion route, or revised findings on data access would materially change the assessment. For Baker Tilly, identification of the service provider, fuller victim totals, a clearer account of the information taken, or further details on support for affected people would do the same.
Inference: the stronger measure of resilience is not the speed or confidence of an initial announcement. It is whether the organization can show that the dependency has been brought back under control: workloads operate for customers in the first case, and affected people receive a bounded, actionable account of their exposure in the second. Until those conditions are evidenced, restoration and notification should be treated as progress markers rather than the endpoint.
Why it matters
Supplier incidents create different obligations for the organizations that rely on them. A cloud provider can restore core services while customers still struggle to recover individual workloads. A firm can begin notifying clients while material questions about a third-party data theft remain unresolved. Treating both as a single “vendor incident” obscures the evidence customers, executives and affected people need to judge whether recovery is real.
Sources
- Ransomware attack on Belarusian cloud firm disrupts businesses for days — The Record from Recorded Future News ·
- In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach — SecurityWeek ·