When Backups Become a Ransomware Target: What You Need to Know

Backups are the safety net that lets a business keep running after a cyber‑attack. In the past year ransomware groups have started wiping those safety nets before they even encrypt the production data, turning a recoverable incident into a data‑loss nightmare.

Recent attacks that hit the backup layer

In February 2024 the ALPHV/BlackCat gang broke into Change Healthcare through a remote‑access portal that did not require multi‑factor authentication. The attackers encrypted the clinical systems and discovered that the organisation’s backups were not isolated from the production network, meaning recovery could not be started quickly.

A similar playbook appeared in 2021 when the BlackMatter group obtained admin credentials and walked across the network of NEW Cooperative and Crystal Valley. Using those credentials they located every backup appliance and either wiped or reformatted the storage before encrypting the remaining data.

More recently, a single stolen credential gave the Gunra ransomware operators access to both the primary data centre and the disaster‑recovery site of an unnamed victim. They deleted backup and archived data at both locations, leaving the organisation with no recent restore point to fall back on.

These incidents illustrate a growing trend: ransomware groups are deliberately targeting backup infrastructure to erase recovery points before the encryption stage.

Why backups are especially vulnerable

Shared networks and credentials

In many organisations the same administrative accounts that manage production servers also have rights over backup servers. When an attacker compromises one of those accounts they can move laterally to the backup environment without needing additional privileges. The lack of a network or credential boundary makes the backup tier an easy next step.

Late patching of backup software

Backup appliances are often treated as static hardware rather than active software. As a result they receive security updates after the production systems have already been patched, or they are left unpatched entirely. Known vulnerabilities therefore remain exploitable for longer periods.

Photo by Brett Sayles on Pexels

Limited monitoring and logging

Security teams normally focus their detection tools on the production environment. Backup servers usually run with minimal logging and weaker access controls, so suspicious activity can go unnoticed until the ransomware payload has already deleted the data.

The business impact of a wiped backup

IBM’s 2025 Cost of a Data Breach Report puts the average cost of a ransomware incident at $5.08 million. The same research found that 41 % of ransomware attacks also carry threats to damage the victim’s brand reputation. When backups are destroyed, downtime stretches out, data‑recovery costs climb, and the public perception of the organisation can suffer long after the technical incident is resolved.

Hardening your backup environment

1. Adopt immutable storage

Write‑once, object‑lock storage prevents anyone, even an administrator, from altering or deleting a backup copy. By making the backup immutable, you remove the attacker’s ability to erase the safety net.

2. Enforce true network and credential isolation

Place backup systems on a separate network segment that does not route to production servers. Use dedicated service accounts for backup administration and protect them with multi‑factor authentication. This stops a single compromised identity from reaching both environments.

3. Patch backup software with the same urgency as production

Treat backup appliances as critical software components. Apply security updates as soon as they are released, and integrate backup patching into the organisation’s regular change‑management process.

4. Strengthen monitoring and logging

Enable comprehensive logging on backup servers and feed those logs into your central security information and event management (SIEM) platform. Set alerts for unusual access patterns, such as admin logins from unexpected locations or bulk file deletions.

5. Conduct regular restore testing

Backups are only useful if they can be restored. Schedule periodic restore drills that include simulated ransomware scenarios. Testing uncovers gaps in the backup chain and validates that the immutable and isolated controls are working as intended.

Photo by panumas nikhomkhai on Pexels

Quick checklist for immediate action

• Verify that backup accounts are separate from production admin accounts and protected with MFA.
• Confirm that backup traffic is confined to a dedicated network segment.
• Enable immutable storage for all critical backup sets.
• Review the patch schedule for backup software and align it with production patch cycles.
• Activate detailed logging on backup servers and integrate alerts into your SIEM.
• Run a restore test at least once a quarter, including a mock ransomware event.

By addressing these five areas you can turn the backup tier from a liability into a resilient line of defence against ransomware.

Key takeaways

• Ransomware groups are now wiping backups before encrypting production data.
• Shared credentials, delayed patching, and poor monitoring create the weakest points.
• Immutable storage, network isolation, prompt patching, robust logging, and regular restore testing are the core controls to protect backups.
• The financial and reputational stakes are high, the average ransomware incident now costs over $5 million.

Implement these measures now to ensure that when the next ransomware wave arrives, your backups remain intact and your business can recover swiftly.