The Backup Application Identity Was the Attack Path. The Vendor’s Containment Suspended the Backup.
Backup application identity: the vendor’s containment suspended the service that ran on it. What the vendor controls, what a tenant administrator controls, and the restore-path check to record before the next incident.