Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber

Daily SMB Cyber Intelligence Brief

SMB Cyber Brief: Supplier incidents, cloud tooling tampering, and service outages – what to watch today

What small and medium-sized businesses should look out for today.

High Tuesday 20 October 2026, 13:42 UK time
Today’s look-out: Supplier incident scams, compromised downloads, and service disruption

What to look out for today

Today’s themes are supplier disruption and supply-chain tampering (compromised downloads/updates). These situations often trigger a second wave of risk for smaller organisations: phishing, fake “support” calls, and urgent payment/access change requests.

  • ConnectWise Cloud Backup incident: ConnectWise says it reset credentials and strengthened admin access protections while Cloud Backup remains offline following unauthorised access to application identities.
  • OVHcloud CLI supply-chain compromise: OVHcloud warns that some GitHub releases of its CLI were tampered with to steal developer secrets.
  • WordPress plugin compromise: Some downloads of Rank Math PRO (SEO plugin) from the vendor’s official site carried malware capable of planting hidden backdoors.
  • Service outage ripple effects: Revolut suffered a major outage affecting online banking services worldwide.
  • Large retailer disruption: Ahold Delhaize reports a cyberattack impacting services across the US and Europe—an example of the kind of upstream disruption that can affect suppliers and logistics.

Why this matters to smaller businesses

  • Backups and recovery: If you or your IT provider relies on ConnectWise Cloud Backup, downtime can affect recovery times and business continuity planning.
  • “Trusted tools” risk: Many SMEs (and their outsourced IT/MSPs) use CLIs, plugins, and vendor downloads as part of normal operations. When those are compromised, passwords/tokens can be stolen and websites can be quietly backdoored.
  • Payment and payroll pressure: Banking outages can push teams into risky workarounds (urgent manual transfers, sharing card details, bypassing approvals).
  • Scam wave likelihood: Criminals routinely exploit high-profile incidents/outages by impersonating vendors, banks, or MSPs to harvest logins and MFA codes.

Warning signs

  • Email/calls claiming to be from ConnectWise/your MSP asking you to “re-authenticate”, “reconnect backups”, “reset MFA”, or share a one-time code.
  • Messages urging you to install a “hotfix tool”, “updated CLI”, or “emergency plugin download” outside your normal update process.
  • Unexpected prompts for WordPress admin logins, new admin users appearing, or unfamiliar plugins/themes installed.
  • Developers/IT seeing unusual credential prompts or signs that tokens/keys may have been accessed.
  • Finance receiving “Revolut is down, use this new account today” payment diversion requests.

How attackers may exploit the situation

  • Vendor impersonation: Sending fake incident notices and directing staff to lookalike login pages to steal credentials/MFA codes.
  • Poisoned updates/downloads: Encouraging IT teams to quickly download and run tools (e.g., a CLI) to “restore service”, capturing secrets and enabling wider access.
  • Website backdoors: Using compromised WordPress plugins to plant hidden access, then redirect traffic, steal form submissions, or pivot to email accounts and invoices.
  • Invoice/payment fraud during outages: When banking is disrupted, attackers try to get businesses to bypass normal approval steps “just this once”.

What to do today

  • Brief staff (10 minutes): No one should share MFA codes or passwords with “support”, even during an incident/outage. Use known contact details only.
  • Confirm your backup position: If you use an MSP, ask whether any of your backups rely on ConnectWise Cloud Backup and what the current recovery options are while services are affected.
  • Freeze “urgent tool installs”: Ask IT to pause any ad-hoc downloads/updates for admin tools and plugins unless verified through your normal process.
  • WordPress check: If you run WordPress and use Rank Math PRO, ask whoever manages your site to validate the plugin source and review admin users and recent changes.
  • Finance controls: During banking disruption, stick to existing approval steps. Treat “new bank details” as high risk and validate via a known phone number.

Ask your IT provider

  • Do any of our backups, DR tests, or restore plans depend on ConnectWise Cloud Backup? What is our workaround while it’s offline?
  • Have you checked whether any of our environments used the OVHcloud CLI releases that were reported as tampered with? If yes, what secrets/keys might need rotating?
  • For our website: do we use Rank Math PRO? If yes, what checks have you done (admin accounts, file integrity, unusual outbound connections, unexpected scheduled tasks)?
  • What’s our process for verifying vendor alerts so staff don’t follow phishing links during incidents?
  • Can you provide a short list of authorised support channels and escalation contacts we should use this week?

Patch watch - only one short paragraph, and only if relevant

Today’s risk is less about routine patching and more about trusting the right update sources. If your business (or MSP) updates developer/admin tooling or WordPress plugins, ensure downloads come from verified channels and that changes are tracked and reviewed before deployment.

One action today

Send a same-day internal note: “No password/MFA code sharing with ‘support’; any vendor/MSP reset request must be verified using our saved contact details,” and remind finance to treat any bank-detail changes as high risk during outages.

Related Actions On Cyber resource

Actions On Cyber checklist: “Supplier incident & outage playbook (what to ask your MSP, backup confirmation, and scam controls)”

Sources

This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.