This Enterprise Techie episode covers who gets SaaS data back when it is deleted, corrupted or encrypted: the 2025 Salesforce data-theft wave, the shared responsibility model, the 2024 UniSuper incident on Google Cloud and five ways SaaS data gets lost. The single most useful takeaway: the provider keeps the service running, but protecting the data is the customer’s job, and at least one copy should sit outside the provider’s control.
Watch the episode on YouTube: SaaS Backup Explained: Microsoft 365, Salesforce & Google.
The video version uses an AI-generated voice of host David Davis, disclosed on YouTube.
In this brief
The question boards skipped
On October 3, 2025, TechCrunch reported that a group known as ShinyHunters, among other names, had launched a leak site threatening to release about a billion records stolen from companies’ Salesforce-hosted databases. The billion is the hackers’ claim; Salesforce said there was no indication its platform had been compromised. Allianz Life, Kering and Qantas were among the companies that confirmed data theft.
Google’s threat intelligence group documented the methods. UNC6040 phoned employees and talked them into authorizing a malicious connected app, with extortion later made under the ShinyHunters name. UNC6395 used compromised OAuth tokens from the Salesloft Drift app to reach Salesforce instances in August 2025. By January 2026, Mandiant was tracking an expansion to more SaaS platforms, including downloads from SharePoint and OneDrive.
Boards asked whether their SaaS data was exposed. The episode asks the twin question: if the data vanished instead, who gets it back?
What the provider promises
Microsoft’s shared responsibility page says that in every cloud deployment type, the customer owns its data and identities and is responsible for protecting them. Google’s Cloud Terms of Service, which now include the Workspace terms, say the customer retains all intellectual property rights in Customer Data. Provider redundancy protects against the provider’s own failures; a deleted mailbox, a botched migration or a phished administrator is the customer’s problem.
A Salesforce help article recommends keeping a regular backup of Salesforce data. Its own fail-safe has a history: Salesforce announced in 2020 that it would end its Data Recovery Service, reversed that in March 2021 after customer feedback, then retired it again after launching a native Backup and Restore product in fall 2021.
The UniSuper incident
On May 2, 2024, services went down at UniSuper, an Australian pension fund with 647,000 members, according to Ars Technica. Google’s incident report says Google operators left a parameter blank during initial deployment, which set one of the customer’s Private Clouds to a fixed term with automatic deletion; that Private Cloud, spanning two zones, was deleted.
A joint statement from UniSuper CEO Peter Chun and Google Cloud CEO Thomas Kurian on May 8, 2024 said UniSuper had duplication in two geographies and the deletion hit both. Backups held with an additional service provider minimized data loss and significantly improved the restoration. Google’s report adds that backups in Google Cloud Storage in the same region were not affected and, with the third-party backup software, were instrumental in the restore. Logins returned on May 9 and full services on May 15.
The lesson: redundancy inside a platform is not a backup of the platform. CISA’s #StopRansomware Guide suggests a multi-cloud approach for cloud-to-cloud backups in case all accounts under the same vendor are impacted.
Five ways SaaS data gets lost
1. Retention windows run out
Deletion starts a countdown. Exchange Online keeps deleted items for 14 days by default, adjustable to a maximum of 30. SharePoint’s recycle bin keeps items for 93 days, and Microsoft keeps backups for 14 more days for full site collection restores requested through support. Salesforce’s Recycle Bin keeps deleted items for 15 days.
2. Human error
In Backupify’s 2025 State of SaaS Backup and Recovery survey of more than 3,700 IT professionals, summarized by The Hacker News, 34% of respondents reported data loss from human error. Malicious deletion was the leading cause, affecting more than 50% of organizations.
3. Compromised administrators
A phished admin account can delete mailboxes and document libraries, and can turn off any retention policy that isn’t locked. Microsoft Purview’s Preservation Lock is the exception: once a policy is locked, no one, including a global admin, can turn it off, delete it or make it less restrictive.
4. Apps and integrations
Connected apps hold OAuth tokens with standing permission to read and write data; a buggy sync or an abused token can overwrite records quietly. Both 2025 Salesforce campaigns came through this door: a malicious connected app in one, compromised Drift tokens in the other.
5. The provider itself
UniSuper did nothing wrong: Google’s report attributes the deletion to its own operators. Rare, catastrophic events are what backup exists for.
The numbers, with sources
| Figure | What it measures | Source |
|---|---|---|
| 14 days | Exchange Online default retention for deleted items (maximum 30) | Microsoft Learn |
| 93 days | SharePoint recycle bin retention | Microsoft Learn |
| 15 days | Salesforce Recycle Bin retention | Salesforce Help |
| 34% | Survey respondents reporting SaaS data loss from human error | Backupify 2025, via The Hacker News |
| May 2 to 15, 2024 | UniSuper, from outage to full restoration of services | Ars Technica |
Retention versus backup
The usual objection: retention policies, litigation holds and recycle bins already exist. Those are compliance features inside the platform, governed by the same admin accounts that are themselves a failure point. The test: can one mailbox, or one record, be restored to exactly how it looked last Tuesday without touching anything else?
As of October 2026, Microsoft 365 Backup is a pay-as-you-go service with a list price of $0.15 per GB per month of protected content, and Salesforce launched a native backup product in fall 2021. Both run inside the provider, so weigh them against the independent-copy test.
What to ask of a SaaS backup
Neither the episode nor this brief ranks vendors. Those working on this problem include, among them, Cohesity, Commvault, Druva, Rubrik and Veeam (listed alphabetically). Ask each shortlisted product to show an independent copy stored outside the provider, point-in-time restore, granular recovery of one mailbox, record or document, and coverage for Salesforce, Google Workspace and other SaaS tools as well as Microsoft 365.
Five questions for your team
- What are the actual retention windows, in days?
- Can a single mailbox be restored to how it looked last Tuesday?
- Does any copy of the SaaS data live outside the provider?
- When was a SaaS restore last tested?
- Beyond email, are Salesforce and Google Workspace covered?
What to do next
- Record the current retention settings for each workload.
- Decide which retention policies need Preservation Lock, knowing a locked policy can’t be reduced or turned off.
- Review connected apps and OAuth grants, and remove unused ones.
- Move admins to phishing-resistant MFA, such as the FIDO2 security keys or passkeys Mandiant points to.
- Keep at least one copy outside the provider, under separate credentials.
- Run and time a granular restore: one mailbox, one record, one site.
Go deeper
- Microsoft 365 backup: what Microsoft covers, and what it won’t
- The 3-2-1-1-0 backup rule: how to implement it
- Backup retention policy: how to set it, with a template
Sources
- TechCrunch, Hacking group claims theft of 1 billion records from Salesforce customer databases, October 3, 2025
- Google Threat Intelligence Group, The Cost of a Call: From Voice Phishing to Data Extortion, June 4, 2025
- Google Threat Intelligence Group, Widespread Data Theft Targets Salesforce Instances via Salesloft Drift, August 26, 2025
- Mandiant, Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft, January 30, 2026
- Microsoft Learn, Shared responsibility in the cloud, updated August 24, 2026
- Google, Google Cloud Terms of Service, last modified September 2, 2026
- Salesforce Help, Best practices to back up Salesforce data, September 22, 2026
- Salesforce Admins, Updates to Salesforce’s Backup and Restore Services: March 10, 2021 and February 7, 2022 (archived)
- Salesforce Help, Manage the Recycle Bin in Lightning Experience, undated
- Google Cloud, Sharing details on a recent incident impacting one of our customers, May 24, 2024
- UniSuper, A joint statement from UniSuper CEO Peter Chun, and Google Cloud CEO, Thomas Kurian, May 8, 2024
- Ars Technica, “Unprecedented” Google Cloud event wipes out customer account and its backups, May 17, 2024
- Microsoft Learn, Recoverable Items folder in Exchange Online, updated July 13, 2026
- Microsoft Learn, Microsoft 365 SharePoint Data Deletion, updated August 31, 2026
- Microsoft Learn, Use Preservation Lock to restrict changes to retention policies, updated September 26, 2025
- Microsoft Learn, Pricing model for Microsoft 365 Backup, updated August 18, 2026
- The Hacker News, 2025 State of SaaS Backup and Recovery Report (on Backupify’s report), January 24, 2025
- CISA, #StopRansomware Guide, September 2023
Frequently asked questions
Does Microsoft back up Microsoft 365 data?
Not as an independent copy by default. Microsoft’s shared responsibility model puts data protection on the customer, native retention runs from 14 to 93 days depending on the workload, and Microsoft 365 Backup is a separate paid service.
How long does Salesforce keep deleted records?
Deleted items stay in the Salesforce Recycle Bin for 15 days. Salesforce recommends keeping a regular backup.
What happened to UniSuper’s data on Google Cloud?
A misconfiguration by Google operators deleted one of UniSuper’s Private Clouds across two zones in May 2024. Backups in Google Cloud Storage and with a second provider survived, and services were fully restored on May 15.
Last checked: October 2026.