On August 5, 2026 at 07:21 UTC, the extortion group Orova listed FixIT Tek — an IT services provider with offices in Ocala and Belleview, Florida — on its leak site, claiming 150 GB. The listing text is one sentence: "FixIT Tek's Syncro MSP panel has been hacked and stolen big data of many clients from their network." Twenty-six hours later, between 09:20 and 11:21 UTC on August 6, the same site added ten more organizations: a thoroughbred training center in Ocala, a dental practice and a property owners association in Summerfield, a master association in Winter Garden, two churches in the Belleview area, a veterinary clinic, an architect, a Central Florida HVAC contractor — and a defunct UK gemstone dealer. As of August 11, neither FixIT Tek nor Syncro has publicly confirmed anything, and no client has publicly named FixIT Tek as its provider. Every claim above is the attacker's.
The 26 hours are not a timeline
The tempting read is a cascade: provider falls Wednesday, clients fall Thursday. Don't take it. WatchGuard's tracker puts Orova's first observed activity in May 2026, with extortion dates for 24 victims running from May 3 to August 3 — all published in a bulk announcement on August 4. Publication order is a marketing decision by a group that monetizes attention. The interval between two leak-site posts tells you when a criminal pressed submit, not when anyone lost access.
The actual compromise dates for those ten organizations are unknown, and the UK gemstone dealer in the middle of the Florida batch is the reminder that the batch was mixed.
What the claim does describe, if true, is a tenant compromise, not a platform one. Somebody got into one MSP's Syncro console — not into Syncro. That distinction decides everything downstream: a platform breach produces a vendor advisory and a coordinated response, while a tenant compromise produces silence, because the only party who knows is the party who least wants to say.
And a console like that is usually entered with a credential rather than an exploit. The same ransomware.live record flags two third-party credentials for fixittek.com in infostealer data, and a FortiBleed hit — the domain's FortiOS SSL-VPN credentials appearing in the Belsen Group dump of 15,000 FortiGate configurations published January 15, 2025, harvested via CVE-2022-40684 three years earlier. Neither is evidence of how this happened. Both are the shape of the thing: no exploit chain, no malware, no anomaly. A valid login to a system whose entire job is running commands on other people's computers.
Treat the console as an admin account in your environment
Because it is one. The RMM agent is signed, allowlisted, frequently excluded from EDR, and you installed it on purpose. There is nothing for your monitoring to catch, because the tool doing the work is the tool you approved.
Four things to establish with your provider, each with a real cost.
MFA on the console, evidenced. In Syncro this is not on by default — a Global Admin has to open Admin → Syncro Administration → Multi-Factor Authentication and click Enable User MFA, and until someone does, technician accounts are password-only. Ask for a screenshot of that screen. Cost to you: nothing. Cost to them: a support burden and an awkward conversation if it has been deferred.
Your own copy of the console audit log. Cost: real, and worth naming. Someone has to receive it and read it, and most small organizations will not. The workable fallback is a monthly export delivered as a file you keep. That is weak, and it still beats the current state, in which the only record of who ran what on your machines lives entirely inside a system you cannot see.
A revocation runbook with a number attached. How many hours from your phone call to every agent removed from every machine on your site — and who executes it when your provider is the incident? An answer of "we'd handle it" is not an answer. This one costs a tabletop hour and usually surfaces that no one has thought about it.
An inventory of what the console held. RMM and PSA platforms accumulate documentation, network diagrams, and stored credentials. If your provider is breached, your notification obligations turn on what was in there — and you cannot notify on data you cannot inventory.
If you have no leverage and your provider will not engage, do the one thing that needs no cooperation: find out which of your machines are actually managed, and by what.
# Run elevated on each Windows endpoint
Get-CimInstance Win32_Service |
Where-Object { $_.PathName -match 'syncro|kaseya|ninja|n-able|connectwise|datto|atera' } |
Select-Object Name, State, StartMode, PathName
Syncro's own footprint appears as Syncro.Service, SyncroLive.Agent and siblings, documented publicly by LOLRMM along with the *.syncromsp.com and kabutoservices.com endpoints the agents call out to. Most organizations discover at this point that the agent is on machines nobody remembered enrolling.
Four checks this week
- Does every technician account at your provider have MFA enforced — verified by a screenshot of the console's MFA page, not by an assurance in email?
- Can you name every machine on your network running a remote-management agent, and which product it belongs to?
- Do you have any record, in your possession, of commands executed on your endpoints in the last 90 days?
- What is the stated number of hours to revoke all agent access, and who runs that procedure if your provider is the one compromised?
The pattern is the same one that showed up when an RMM vendor shipped an authentication bypass fix without telling anyone: remote management is an administrative plane that sits outside everything you monitor, and the failures in it are invisible from the inside by design.
North InfoSec runs AI-assisted penetration testing and security assessments, including third-party and remote-management exposure of the kind described above. northinfosec.com