A practice manager forwards you an email on a Monday. It looks like a Xero notification about a failed payment, the branding is right, the login page is a pixel match. A staff member typed their password into it on Friday afternoon. Over the weekend, someone logged into three client organisations, changed the bank account on a batch of bill payments, and deleted the trail behind them.
Nobody encrypted anything. There was no ransom note. The damage is just as real.
When people picture ransomware, they picture files on a laptop turning into gibberish with a countdown timer. That model does not map cleanly onto Xero. Your data does not sit on a machine an attacker can encrypt. It sits inside Xero's cloud. What attackers go after instead is the way in: the credentials. Once they hold a valid login, they do not need to break anything. They just sign in and act like a user.
Why "Ransomware" Looks Different in the Cloud
Traditional ransomware needs access to a file system. Xero organisations live on Xero's infrastructure, so there is no local file for malware to seize. That sounds reassuring until you follow the logic through.
The attacker's goal has shifted from encrypting your files to controlling your account. Credential theft is the whole game. A stolen password, a hijacked session, or a malicious app connection gives someone the same access your bookkeeper has. From there they can delete transactions, alter payment details, export contact data, or lock out the real users by changing settings.
Some incidents still end in an extortion demand. The attacker exfiltrates client financial data and threatens to publish it, or destroys records and offers to "help" for a fee. The mechanics are different from a classic file-encryption attack, but the outcome you care about is identical. Your data is gone, altered, or held over you.
The Attack Paths That Reach a Xero Organisation
Most compromises trace back to a small number of routes.
- Phishing and lookalike login pages. The most common entry point. A convincing email drives a user to a fake Xero sign-in page that captures the password, and often the multi-factor code in real time.
- Reused passwords. A password exposed in an unrelated data breach gets tried against Xero logins. If a staff member reused it, the attacker walks in.
- Session hijacking. Malware on a user's device steals an active session token, sidestepping the password and MFA entirely.
- Malicious or over-permissioned app connections. A connected app with write access to the organisation becomes a back door if that app or its credentials are compromised.
- Departed staff and stale access. An offboarding step that never happened leaves a live login for someone who no longer works there.
Multi-factor authentication blocks a lot of this, and every practice should enforce it. It is a wall, not a roof. Real-time phishing kits and session theft are built specifically to get around it.
What an Attacker Can Actually Do Inside Your Xero Org
This is the part that changes how you think about backup. Once inside, an attacker holds legitimate access, so their actions look like ordinary user activity.
They can bulk-delete invoices, bills, and contacts. They can change bank account numbers on payment runs so funds route to them. They can alter historical transactions to hide the fraud. They can remove other users or change the authorised signatories. Because Xero records who did what, the audit log will show the activity, but the log tells you what happened. It does not put the data back.
Xero protects the platform and keeps its own infrastructure resilient. Restoring your individual organisation to its state last Thursday, before the intrusion, is not something the platform does for you. That is the gap credential attacks exploit.
Why an Independent Backup Is the Recovery Path
If an attacker with valid credentials can reach and destroy your live data, then your recovery cannot depend on that same environment. It has to sit somewhere they never touched.
WOW Backup and Restore captures your Xero organisation daily and stores it independently, in regional cloud storage separate from your live Xero login. An intruder who compromises a user account does not gain access to those backups. When the dust settles, you have a clean copy from before the breach.
The restore itself is built to be safe under exactly these conditions. WOW does not write back into the compromised organisation. It provisions a brand-new Xero organisation through Xero's official OAuth flow and rebuilds your data into it, from a snapshot you choose. Your live org stays exactly as it is, which matters when you are still working out the scope of an incident and do not want to overwrite evidence. You end up with a clean organisation to move forward on, while the affected one can be locked down and investigated.
Two honest caveats apply here, as they do with any Xero restore. Bank feeds need manual reconnection on the new organisation, since feed authorisations are tied to a specific org. And a restore rebuilds the whole organisation rather than a single record, so if you only need to recover a handful of altered invoices, you restore to a new org and reference them from there.
What to Do Before It Happens
The firms that come through a credential attack with their week intact did the boring work early.
- Enforce multi-factor authentication on every Xero login, without exceptions for partners.
- Review connected apps quarterly and remove anything unused or over-permissioned.
- Tighten offboarding so access is pulled the day someone leaves, not the month after.
- Connect an independent backup now, and run a test restore while nothing is wrong, so the process is familiar under pressure.
A Xero backup does not stop an intrusion. It removes the leverage. An attacker who deletes your data is only holding something over you if that data exists in one place.