For most of the past two decades, a backup was treated as the quiet insurance policy of the business network. It sat in the corner of the server room, or later in a cloud console, and it was rarely thought about until the day it was needed. That era can be considered officially over. Ransomware crews have changed their playbook, and the first thing many of them now look for is not the production data at all. It is the copy that was supposed to save the business.
Why Backups Are Now the First Target
The reasoning behind the shift is straightforward leverage. A ransomware attack is only a negotiation if the victim has no other way to recover, and a healthy backup is precisely that other way. Industry research has found that the overwhelming majority of ransomware incidents now include a deliberate attempt to locate, encrypt, or delete backup repositories before the main encryption event is triggered. When the recovery path is destroyed first, the pressure to pay rises sharply, and the options available to the victim collapse to one.
This is not a theoretical concern. In August 2026, a joint advisory from CISA and the FBI documented the Gunra ransomware operation, in which attackers deleted backup and archived data at both an organization's primary data center and its disaster recovery site. Two locations meant very little, because both were reachable with the same set of stolen credentials. Earlier crews such as BlackMatter made the same tactic standard procedure, wiping backup appliances before anything else was touched. A recent analysis of these campaigns draws the uncomfortable conclusion plainly: a backup is only a safety net if the attacker cannot reach it.
In our own client reviews over the past few years, the most consistent weakness we have found is not the absence of backups. It is the quiet sameness of them. The same administrator account that opens the file server also opens the backup console. The backup server lives on the same network, is patched on a slower schedule, and is watched less closely than production. From an attacker's perspective, that combination is not an obstacle; it is an invitation.
What Actually Protects the Copy That Saves You
The protections that matter now are less about how many copies exist and more about what connects to them. Immutable storage, where a backup copy is written once and cannot be altered or deleted for a defined retention period, has shifted from an advanced measure to a baseline expectation, and it is now supported across most modern cloud platforms. Credential isolation matters just as much; the accounts that administer backups should not be the accounts that administer production, and multi-factor authentication should be required on every backup console without exception. Backup software itself must be patched with the same urgency as any production system, because attackers keep careful track of what has been left behind.
None of this replaces the fundamentals covered in our earlier piece on the difference between backup and disaster recovery. A copy of the data is not a plan, and a plan is not proof. The only honest evidence that a recovery will work is a restore that has actually been tested, ideally under conditions that simulate a real attack. It should also be remembered that the initial access point is often a remote tool or a stolen login rather than exotic malware, a risk examined in our article on remote access tools. Hardening the front door still protects the vault.
For a small or mid-sized business, the practical takeaway is that backup strategy deserves the same scrutiny as any other part of the security program. The question is no longer only whether backups are being made, but whether a determined attacker with one compromised account could reach every copy that exists. If the answer is yes, the safety net has a hole in it, and it is far better to find that hole during a review than on the worst day of the company's year.
