Background

In October 2026 the software vendor behind Webvault Offsite Backup Manager services disclosed serious security vulnerabilities affecting its backup management software.  These vulnerabilities were actively exploited by attackers and resulted in unauthorised access to backup server environments.

In response, Webvault has completely rebuilt its Offsite Backup Manager infrastructure, upgraded to the supplied vendor repaired software versions of the software platform and restored customer account configurations from backups taken before the security incident.

Although the affected infrastructure has been replaced, we are recommending additional security measures to protect customer accounts and backup data.

Why Customers Should Take Action

There are two important aspects of backup security that customers should review.

1. Backup Account Passwords

Your account password controls access to your backup account.

Following a security incident involving the backup management platform, changing your account password is an important precaution against potential unauthorised access.

We recommend that all existing customers change their backup account passwords as soon as possible by following this guide: 

Offsite Backup Manager: Changing Your Account Password

2. Backup Encryption Keys

Your backup encryption key is used to encrypt the contents of your backups.

Depending on when your backup account was originally created, your encryption key may have been generated automatically, configured separately, or derived from an account password.

Importantly, changing your account password does not change the encryption keys used to protect existing backups.

Customers must securely retain their existing encryption keys and any historical passwords that may have been used for backup encryption.

For additional protection, customers may also wish to establish new backup sets using newly generated encryption keys.  This requires additional planning because historical backups remain encrypted using their original keys.

Read the Following Guides

• Offsite Backup Manager: Understanding and Protecting Your Backup Encryption Keys
• Offsite Backup Manager: Replacing Your Backup Sets with New Encryption Keys

Recommended Actions

We recommend that existing customers:

1. Change their backup account password to a new, unique password.

2. Review and securely preserve their backup encryption keys, including historical passwords that may have been used for encryption.

3. Consider establishing new backups with fresh encryption keys.

4. Verify their backups are functioning correctly and periodically test restoring important files.

Detailed instructions are available in our accompanying knowledge base articles.

Further Information

Webvault is also progressively upgrading customer backup software as part of the infrastructure improvements.

Customers who require assistance changing their passwords, locating encryption keys or reviewing their backup configurations are encouraged to contact support@webvault.com.au.