Stop Calling It Cloud Storage: Backup Attack Resistance
Offsite backups in APAC often lack true air‑gap, immutability and recoverability, leaving them exposed to ransomware. Veeam Vault offers a managed, logically air‑gapped, immutable storage service that meets regulatory demands and real‑world needs.
In the Asia Pacific, organisations that rely on offsite backups are facing a hidden weakness that ransomware groups are exploiting. The region’s rapid cloud adoption has created a false sense of safety, yet many backup repositories lack true isolation, immutability and guaranteed recoverability.
Why traditional offsite backups fall short
A 2025 ransomware report from Veeam found that 89 % of organisations hit by ransomware had their backup repositories targeted. Even more concerning, only 32 % of those organisations used repositories configured as immutable. Without immutability, an attacker who gains access to a backup store can encrypt or delete the very copies meant to restore operations.
Regulatory pressure is rising
Regulators in the region are tightening the rules around backup protection. The Australian Prudential Regulation Authority (APRA) now expects entities to maintain sufficient isolation of backups from the production environment and to prevent any single account from having permission to modify or delete both. Similarly, the Reserve Bank of India (RBI) requires half‑yearly testing that backup data can be recovered without loss, a near‑zero recovery point objective (RPO) and a disaster‑recovery (DR) facility in a different seismic zone. Failure to meet these standards can result in penalties and loss of licence.
Real‑world incidents underline the risk
In June 2024, an Indonesian national data centre disclosed that 98 % of the data in one facility had no backup at all because backup was an optional, chargeable add‑on that agencies declined on budget grounds. The incident left critical public‑sector data exposed and highlighted how cost‑driven decisions can undermine resilience.
Photo by panumas nikhomkhai on Pexels
A managed solution that meets the gap
Veeam Vault is a Veeam‑managed storage service that is logically air‑gapped from the customer environment. Backups land in a write‑once, read‑many state by default; immutability cannot be switched off and no administrator, script or root‑level user can alter or delete data before its retention period expires. The service is available in 50 + regions across 27 countries on Azure and AWS, including 22 regions in Asia Pacific and Japan such as Australia, Hong Kong, India, Indonesia, Japan, Malaysia, New Zealand, Singapore, South Korea, Taiwan and Thailand.
Extending protection to long‑term retention
Veeam Vault Archive builds on the same immutable, air‑gapped model for long‑term retention, allowing organisations to keep compliance‑grade archives without sacrificing security.
Customer success story
Premier Bank PLC in Bangladesh switched to immutable, encrypted, air‑gapped storage and cut recovery time objectives by 65 % while reducing backup‑management effort by 75 %. The bank cites the same features that Veeam Vault provides as the cornerstone of its ransomware mitigation strategy.
Photo by panumas nikhomkhai on Pexels
What to check in your own environment
- Is your backup repository immutable? Verify that write‑once policies are enforced and cannot be overridden.
- Are backups isolated from production systems? Ensure that no single account can modify both production and backup data.
- Do you meet regulator‑defined RPO and DR location requirements? Test recovery half‑yearly and confirm a geographically separate DR site.
- Is long‑term retention protected by the same controls? Look for solutions that extend immutability beyond the primary retention window.
Terms used in this article
- Air‑gap, a security measure that physically or logically separates a system from networks that could be compromised.
- Immutable, data that cannot be altered or deleted once written, often enforced by write‑once policies.
- Recovery point objective (RPO), the maximum age of files that must be recovered after a failure.
- Disaster‑recovery (DR) facility, a secondary site used to restore operations after a catastrophic event.
- APRA, Australian Prudential Regulation Authority, the regulator for financial institutions in Australia.
- RBI, Reserve Bank of India, the central banking institution that issues cyber‑resilience guidelines.
By treating offsite backups as a critical line of defence rather than an after‑thought, organisations can close the gap that ransomware actors are exploiting today.
