SUCCESS

When a company’s senior creditors engage a restructuring adviser, the bond market reads it as a warning.

For JetBlue Airways (JBLU), a Wall Street Journal report that a group of senior creditors had hired restructuring adviser PJT Partners sent shares to a new low and put the airline’s balance sheet under a public spotlight it did not welcome.

The stock recovered sharply. JetBlue rose nearly 19% in early trading after its third-quarter earnings report, even though the company posted a wider quarterly loss. Investors chose to focus on management’s fourth-quarter outlook and a stated target for reaching profitability by 2028.

Chief Executive Joanna Geraghty did not sidestep the creditor issue. “We have no intention, no plans to file for bankruptcy. We are not engaged with any restructuring company,” she told CNBC.

She described a “fundamental disconnect between the narrative in the bond market and what our financial results actually demonstrate.”

Why JetBlue’s Q3 loss was wider

JetBlue posted a net loss of $257 million for the three months ended Sept. 30. A year earlier the loss was $143 million. The airline’s fuel bill climbed 61% to $868 million, accounting for most of the wider shortfall.

Also read: JetBlue has a boarding policy designed to anger passengers

The balance sheet tells a different story than the income statement. JetBlue ended the quarter with $2.2 billion in liquidity. Its unencumbered asset base, collateral the company could draw on in a financing, stood at $7 billion, including $2.8 billion in aircraft and engines. Those are the figures management pointed to when arguing the restructuring concern does not match the operating reality.

Revenue per available seat mile (RASM), a standard measure of how efficiently an airline converts capacity into revenue, is expected to rise as much as 22% in the fourth quarter from a year earlier. That would bring the full-year increase to between 13.5% and 14.5%. The fourth-quarter guidance was the number investors reacted to most.

Average fares backed up the revenue outlook. JetBlue’s average fare in the third quarter rose more than 19% from a year earlier to $245.11, up from $205.67. The company said travel demand has held firm even at higher price points.

JetBlue’s case for $1 EPS by 2028

Chief Financial Officer Ursula Hurley said the company has sufficient liquidity and financing options to reach its 2028 targets. She put those targets at a minimum of $1 in earnings per share and positive free cash flow by that year.

“JetBlue believes it has the liquidity and financing options to build a strong bridge to at least $1 in earnings per share and positive free cash flow in 2028,” Hurley said.

JetBlue has not posted an annual profit since 2019. Getting from the current loss position to the 2028 target requires the company to sustain higher fares, expand premium revenue, hold down costs and reduce debt, in a sequence that leaves little room for one of those to slip.

A new domestic first-class section recently went on sale as part of the premium push. The product is designed to attract higher-spending travelers and lift unit revenue above what a coach-only cabin can generate. That move places JetBlue alongside a broader industry trend toward premium differentiation, though the airline is doing it with a more constrained balance sheet than its larger competitors.

JetBlue carried $8.4 billion in total debt as of Sept. 30. That number, alongside the fuel cost jump, is the source of the creditor concern Geraghty pushed back against.NurPhoto / Getty Images

The risks that haven’t gone away

JetBlue carried $8.4 billion in total debt as of Sept. 30. That number, alongside the fuel cost jump, is the source of the creditor concern Geraghty pushed back against. Servicing that debt while the company is still posting net losses narrows the margin for operational setbacks.

Higher jet fuel costs have affected the whole industry. JetBlue is more exposed than most of its competitors. Delta (DAL), American, and United carry a wider mix of revenue sources and deeper cash reserves. A fuel spike that a larger carrier absorbs in a quarter can push JetBlue’s 2028 results well below what management has projected.

More Travel:

“The Traitors” has luxury travelers flocking to castles all over the UK

Costco brings back Disneyland ticket deal that could save hundreds

Another travel agency shuts down after 19 years

The strategic setbacks of recent years compounded the debt burden. JetBlue’s attempted acquisition of Spirit Airlines was blocked by a federal judge. A regional partnership with American Airlines (AAL) was also blocked by regulators.

JetBlue now has the Blue Sky partnership with United Airlines (UAL), but neither deal replaced what a Spirit combination would have provided: a lower cost structure and more domestic capacity at competitive price points.

The company has said it is not pursuing another large acquisition. That means the internal turnaround is the full plan. RASM growth, cost control, debt reduction and premium-seat adoption all have to move in the right direction at the same time.

A deterioration in any one of those would put the 2028 timeline under renewed pressure.

How JetBlue proves the CEO right

Fourth-quarter RASM is the first test. Geraghty and Hurley pointed to the up-to-22% increase as evidence the revenue picture is improving. If the actual result comes in below that range, the creditor narrative will return. If it lands at or above guidance, it starts to support the argument that the bond market is reading the company’s situation incorrectly.

Fuel costs in the fourth quarter will run alongside the revenue question. The 61% increase in Q3 was the main reason the net loss widened from a year earlier. A sustained rise in jet fuel prices could offset fourth-quarter revenue gains and push the result below what management has projected.

Debt reduction is the longer test. At $8.4 billion in total obligations, JetBlue needs to generate consistent positive cash flow before it can begin to bring that figure down. The 2028 free-cash-flow target is the starting point for that process, not the end of it. Investors watching the stock from here need to track whether the company’s cash position is improving each quarter, not just whether earnings guidance is being met.

The stock climbed nearly 19% after the report. Geraghty’s case for the company’s health centers on the Q4 revenue guidance and the $7 billion in unencumbered assets she cited on the earnings call. Those numbers get tested when the fourth-quarter report comes out.

Related: JetBlue creditors hire bankruptcy advisers as debt concerns grow

Every business owner keeps a mental list of the keys that matter. The bank login, the payroll account, the alarm code for the front door.

What rarely makes that list are the apps your IT provider plugged into your company email years ago. They don’t log in like a person or get a text code. They just run in the background.

Most small companies outsource IT to managed service providers, or MSPs, which wire backup and security tools straight into each client’s Microsoft 365 account.

Each tool holds standing permission to read and write your data with no person signing in, according to Help Net Security. For you, that’s convenience. For a hacker, it’s a skeleton key.

Last week, one of those keys was stolen. Attackers took a credential for ConnectWise Cloud Backup, a tool many MSPs use to back up clients’ email and files, and used it to walk into company accounts one after another.

If your IT is outsourced, this story deserves ten minutes of your week.

Hackers exploited ConnectWise credentials to breach Microsoft 365 accounts, exposing businesses to lasting security risks and financial losses.SOPA Images / Getty Images

What happened in the ConnectWise breach

On Oct. 15, someone using the backup app’s identity started requesting access to customer accounts from a hosting-provider address, according to BleepingComputer. ConnectWise, which bought SkyKick in September 2024, disclosed the problem the next day, Techzine reported.

Huntress, a security firm that watches over small businesses, saw sign-in attempts from the attackers’ address on about 1,000 Microsoft accounts, and around 300 of them succeeded, according to Security Affairs.

ConnectWise disabled seven application identities on Oct. 17 and took Cloud Backup offline. It later suspended its SaaS Security and Cloud Management services too, Dark Reading reported.

Related: Polymarket customer struggles to claw back funds lost to fraud

On Oct. 21, Microsoft named a culprit. It said Storm-0940, a China-state-aligned group active since 2021, used an AI-driven hacking tool called ARTEX to hit more than 2,250 accounts at a pace of 2,900 sign-in attempts per minute, according to CSO Online.

In several cases, the group went from picking a target to privileged access in under three hours, Microsoft wrote in its report, as quoted by Security Affairs. Most attempts failed. The ones that landed moved fast.

Why a stolen key can cost you real money

A backup tool has to see everything it protects. The compromised app could reach mailboxes, OneDrive and SharePoint files, Teams chats and the company directory, according to Cybernews.

Email is where small business money usually disappears. Business email compromise cost U.S. victims just over $3 billion in 2025, according to an analysis of FBI data cited by Insurance Business.

More Cyber Threats:

Bernie Sanders sounds alarm on AI agents in your bank account

Amazon caught hackers probing a PHP flaw 4 days before the fix

Meta Muse closes dangerous privacy loophole after researchers exploit it

The FBI logged 24,768 of those complaints [VERIFY vs IC3 2025 report]. By my math, that’s roughly $123,000 lost per reported case.

The scheme is simple. A crook sitting in your mailbox studies how you bill, then emails a customer a real-looking invoice with new bank details, or asks your bookkeeper to update a vendor’s account. With a hijacked account, the email really does come from you.

For a company with 20 employees, one diverted payment of that size can mean a missed payroll or a drained credit line. That’s the dollar stake behind a story that sounds technical.

Here’s what researchers found inside affected accounts:

In about 50 accounts Huntress monitors, ConnectWise management apps gave themselves directory roles, mostly Exchange Administrator, according to BleepingComputer.

In at least one, a ConnectWise Teams app made itself a global administrator and, within about five minutes, added new credentials to two other trusted apps, Help Net Security reported.

After getting in, the attackers changed app credentials and tried to alter privileged roles, Microsoft said, according to The Hacker News.

Switching off the app doesn’t lock every door

ConnectWise says its stored backup archives remain encrypted and isolated, with no sign they were touched, according to Dark Reading. The company has also said it can’t see inside customer accounts, so it can’t tell whether any one business was hit, a separate Dark Reading report noted.

That leaves the cleanup to you and your provider. Microsoft warned that the attackers’ changes “can remain active as a backdoor” even after the original app is fixed, according to CSO Online.

Here’s the detail I’d flag for every owner: you may be exposed even if you stopped using SkyKick years ago. ConnectWise told partners to check accounts with dormant SkyKick connections, according to Techzine, because the permission stays in place until someone removes it.

Huntress also told administrators to disable the ConnectWise apps rather than delete them, and to check every app for credentials added since Oct. 13, iTnews reported.

Three questions to ask your IT provider this week

I asked Elli Shlomo, head of security research at Guardz, a cybersecurity company that sells to MSPs, what an owner with no security staff should actually do. He boiled it down to three questions.

“First: ‘Was the ConnectWise Cloud Backup app connected to our Microsoft 365, is it disabled now, and did you check the sign-in logs for activity that didn’t come from the vendor?’” Shlomo said.

“Second: ‘What changed while it was connected?’” he said. “In some tenants the app gave itself administrator rights and added new credentials to other apps, so you want a check for new admin roles, new app secrets and new mailbox forwarding rules, not just a password reset.”

His third question looks past this one vendor. “Third: ‘Which other vendor apps hold this kind of access to our email and files, and when were they last reviewed?’ A good provider has already done all three and can show you the evidence,” Shlomo said.

That last line is the real test. If your provider can’t hand you a written answer, you’ve learned something about who’s guarding your accounts.

Ransomware crews now hunt for company backups

On Oct. 20, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and international partners warned that SafePay, one of 2026’s most active ransomware crews, has hit about 600 victims since August 2024, according to HSToday.

SafePay operators shut off a built-in Windows snapshot service and reset network storage drives holding backups to factory settings. In some cases they deleted every network-attached backup before negotiations began, GBHackers reported.

The agencies’ fix is familiar advice with new urgency. Keep backups that are offline, encrypted and impossible to alter, and regularly test that you can restore from them, according to HSToday.

There’s a practical gap to close, too. ConnectWise Cloud Backup has been paused since Oct. 17, so ask your provider whether your email has been backed up since then and when restores return].

This breach will fade from the headlines. The permissions it exposed won’t, unless someone goes looking for them.

Ten minutes and three questions this week could spare you a six-figure invoice scam later. For the business you’ve spent years building, that’s cheap insurance.

Related: When AI attacks, who fights back?