Ransomware Backups: Why Your Backups Are Your Last Line of Defense
Quick answer: Ransomware crews now go after backups before they encrypt anything, because a company with no clean copy is far more likely to pay. To protect your ransomware backups, keep at least one immutable or air-gapped copy, give backup systems their own credentials and MFA, and test real restores on a schedule. A backup you haven’t restored is an assumption, not a plan.
Updated October 2026
Why do ransomware attackers target backups?
Backups are the reason a victim can refuse to pay. Destroy them and the attacker’s leverage jumps. In a 2024 Sophos study of nearly 3,000 ransomware victims, 94% said attackers tried to compromise their backups, and 57% of those attempts succeeded.
The result shows up in the bill. Organizations with compromised backups were almost twice as likely to pay the ransom (67% vs. 36%). Their median recovery cost was $3 million, compared with $375,000 when backups stayed intact.
How often do ransomware backups actually save the day?
Backups remain the most common way out. In Sophos’s State of Ransomware 2026, 66% of organizations whose data was encrypted recovered using backups, up from 54% the year before. Still, 48% paid the ransom, with a median payment of $769,000.
| Outcome | Backups intact | Backups compromised |
| Paid the ransom | 36% | 67% |
| Median total recovery cost | $375,000 | $3 million |
| Fully recovered within a week | 46% | 26% |
Source: Sophos, The impact of compromised backups on ransomware outcomes.
What is the 3-2-1-1 backup rule?
The classic 3-2-1 rule was built for hardware failure, not a human attacker inside your network. The ransomware-ready version adds one more copy:
- 3 copies of your data
- 2 different types of storage
- 1 copy offsite
- 1 copy immutable or air-gapped, so it can’t be changed or deleted, even by an admin account
What makes ransomware backups resilient?
- Make one copy immutable. Use object lock or immutable snapshots with a retention period attackers can’t shorten.
- Separate backup credentials. Backup consoles should not use domain admin accounts. Require MFA and a separate identity.
- Isolate the backup network. Limit which systems can reach backup storage, and log every access.
- Watch for warning signs. Alert on deleted snapshots, changed retention policies, and unusual backup job failures.
- Test restores quarterly. Restore real systems into an isolated environment, check data integrity, and time how long it takes.
- Document the recovery order. Know which systems come back first, such as identity, then core apps, then everything else.
Frequently asked questions
An immutable backup is a copy that can’t be modified or deleted until its retention period ends. Even an attacker with admin credentials can’t encrypt or erase it.
Only with an added immutable or offline copy. Standard 3-2-1 copies are often reachable from the same network and credentials the attacker already controls.
At least quarterly, and after major system changes. A good test restores full systems, not single files, and measures the actual time to recover.
The FBI discourages payment, and paying does not guarantee your data comes back. Clean, tested backups are what give you the choice not to pay.
Report it to the FBI through IC3 and to CISA. Contact your cyber insurer and legal counsel early as well.
Make sure your last line of defense holds
Tego designs immutable backup, disaster recovery and tested recovery runbooks as part of our enterprise managed services. Talk with our engineers about a recovery-readiness review.
Sources: Sophos State of Ransomware 2026 · Sophos: Impact of compromised backups · CISA StopRansomware · FBI IC3