Managed Service Providers Face Growing Security Threats
Acronis identifies MSPs as primary targets for attackers seeking backdoor access to client data and networks.
Updated on Oct. 30, 2026 in Cybersecurity
Live Poll
Do you trust third-party IT providers to manage your sensitive data securely?
Acronis CISO Gerald Caron has identified managed service providers (MSPs) as primary targets for cyberattacks because of their deep, privileged access to client systems. This assessment follows several high-profile regional security incidents, including the June 2026 ransomware attack on Mackay Sugar.
Why it matters
MSPs are increasingly viewed as strategic conduits for ransomware groups because a single compromise grants attackers backdoor access to the networks of multiple downstream customers. Consolidating security infrastructure is now a central focus for vendors aiming to reduce the management overhead that often leads to critical vulnerabilities.
Caron has outlined a three-pronged strategy to fortify security, focusing on tool consolidation to minimize the attack surface managed by service providers. This approach aims to counter methods used by groups like The Gentlemen, who combine data encryption with extortion tactics.
The players
Gerald Caron
The current Chief Information Security Officer at Acronis who is focusing on consolidating partner security tools.
Acronis
A provider of cybersecurity and data protection software that enables MSPs to manage client environments.
The Gentlemen
A threat actor group that executes ransomware attacks combining data encryption with extortion to force payment.
Australian Signals Directorate
The Australian government agency responsible for foreign signals intelligence and cyber warfare.
The details
Attackers frequently breach MSPs using spear phishing—the use of deceptive emails to steal credentials—or by exploiting unpatched, internet-facing hardware. Once inside, they utilize remote monitoring and management (RMM) tools, which are software suites that allow administrators to manage a network remotely, to deploy ransomware or steal data for extortion. The Gentlemen, a threat actor group, specifically uses this model to encrypt systems and threaten the public release of sensitive client information.
Timeline
March 2026: Australian Signals Directorate issued an advisory regarding INC Ransom.
June 2026: A ransomware attack disrupted operations at Mackay Sugar.
September 2026: An Auto IT security incident occurred involving a third-party tool.
October 2026: Gerald Caron began his tenure as Acronis CISO.
The Tech Race
The focus on MSP security follows a series of regional incidents, including the 2026 Mackay Sugar breach, which highlighted the danger of unsecured remote management tools. Protecting these central points of failure is now the primary objective for vendors competing in the managed services market.
Service providers and their clients should monitor for future updates regarding the consolidation of security tools planned for the coming year. These changes aim to reduce the reliance on fragmented software, potentially hardening defenses against attackers using stolen remote-access credentials.
The takeaway
Managed service providers remain the highest-value targets for attackers because they function as a single point of failure for numerous client networks. Monitor upcoming product roadmap announcements from security vendors to see which specific tools are slated for integration in the next calendar year.
Further reading
Explore the evolving Cybersecurity landscape to see how vendors are adjusting to new threat vectors.
Source note: This article includes information reported by Crn.
Live Poll
Do you trust third-party IT providers to manage your sensitive data securely?
