Why ransomware targets your backups first
Ransomware operators delete or encrypt backups before touching production, because a business with no recovery path pays fastest. Immutable, off-environment backups remove that leverage.
Ask why a ransomware attack succeeded and the answer is usually the encryption. Ask why the ransom got paid and the answer is almost always the backups — or rather, their absence at the moment they were needed.
The economics of leverage
Modern ransomware is a financial operation. The operator's product is leverage: the gap between what recovery costs you on your own and what they charge for the key. Working backups collapse that gap to near zero. So the playbook inverted years ago — gain access quietly, find the backup infrastructure, destroy or encrypt it, and only then detonate on production.
Why conventional backups lose
Most backup setups fail this scenario for one structural reason: they are reachable from the environment they protect.
- Backups on a network share can be encrypted like any other file.
- Backup servers joined to the same domain fall with the domain admin credential.
- Cloud backups deletable through a console fall with the console credential.
If one set of stolen credentials can touch both production and its copies, you do not have a backup — you have a second copy of the problem.
What actually holds
The property that matters is immutability: backups written to storage that cannot be altered or deleted inside the retention window, by anyone, including your own administrators. Pair that with replication of the environment itself — not just data — and recovery stops being a negotiation. You redirect to the uncompromised copy, roll back to a known-good point, and the operator is left holding leverage that no longer exists.
The test is simple to state and uncomfortable to run: assume every credential in your business is in an attacker's hands, then ask what they can do to your backups. If the honest answer is "delete them," that is the first thing to fix — before the endpoint tooling, before the awareness training, before anything else.