Safe Data Storage Ltd, a UK managed cloud-backup provider that sells largely through IT resellers, says it found the attack on Tuesday Oct 13. It's limited to its London and Replication servers. Its SAFE C2C service (on AWS S3) and its overseas 'world' servers weren't affected. In its own Q&A the company says the backups 'and the servers they sit on have all been encrypted', backups aren't running and customers can't restore, and it has no recovery timeline. It says the data was encrypted at rest and it doesn't hold customers' passwords or encryption keys, so it doesn't believe customer data was accessed or copied, but it can't rule out that usernames were taken. In an Oct 16 letter, managing director David Cleaver says the attackers used a newly discovered flaw in the backup application: it was disclosed on a Friday, the vendor's first two patches didn't fully fix it, and the attackers struck before a working fix arrived. The company has reported the attack to the ICO, the NCSC and the Metropolitan Police, and it's rebuilding accounts on clean SAFE Backup servers. It tells customers to put a new backup in place now. Our read, not confirmed: the company doesn't name the application, but it has long called itself Ahsay's largest UK partner and replicates between two UK data centres with Ahsay Replication. The timeline also matches the AhsayCBS chain (CVE-2026-105133/105134), which was exploited from Oct 7 and whose first patches Ahsay said on Oct 12 were incomplete. If you resell or run AhsayCBS, see the Ahsay items on this board.