Backups are the plan B that most businesses never test. Attackers know this, which is why they look for your backup repositories before encrypting anything. This guide covers why backups fail at the exact moment you need them, what an immutable backup changes, and how to find out where you stand before an incident answers the question for you.
Key Takeaways
- Attackers attempted to compromise backups in 94% of ransomware attacks, and succeeded in 57% of those attempts (Sophos analysis of 2,974 ransomware victims).
- When backups were compromised, median recovery costs were eight times higher: $3M against $375K.
- Only 26% of businesses with compromised backups fully recovered within a week, against 46% of those whose backups survived.
- Ransom demands roughly doubled when backups were compromised, and victims paid 98% of the sum demanded on average because they had nothing to negotiate with.
- Backups usually fail for reasons unrelated to backup software: shared credentials, repositories reachable from the production network, retention windows shorter than the attacker’s dwell time, and restores that were never tested.
- An immutable backup cannot be altered or deleted for a set retention period, even by an administrator account. That property is what separates a copy of your data from a copy an attacker can destroy.
Quick Answer
If your backups fail during a cyberattack, you lose the ability to restore, leaving you with only two options: pay the ransom or rebuild from scratch. Businesses in that position pay roughly double the ransom demand, spend around eight times more on recovery, and take substantially longer to return to normal operations. Backups fail mostly because attackers access them using the same administrator credentials used to manage production systems. An immutable backup, which cannot be deleted or encrypted and is retained for a fixed period, is the single most effective control against that outcome.
Backups Are a Target, Not an Afterthought
There is a common assumption that ransomware encrypts what it finds, and backups sit safely out of the way. The data says the opposite. Sophos analysis of 2,974 organizations hit by ransomware found that attackers attempted to compromise backups in 94% of attacks, and that 57% of those attempts worked.
That is deliberate sequencing. Destroying or encrypting the backups first removes your alternative to paying, which is why it happens before the ransom note appears. Attackers are not hunting for data at that stage. They are removing your options.
Of ransomware attacks included an attempt to compromise backups
Of those attempts succeeded across all sectors
Higher median recovery cost when backups were compromised
Average ransomware recovery cost, up 11% year over year (Sophos, 2026)
What Actually Happens to the Business?
The gap between a surviving backup and a compromised one is visible in every number that matters to an owner or finance director.
| Category | Median recovery cost | Cost |
|---|---|---|
| Backups compromised | $3M | |
| Backups protected | $375K |
| Category | Recovered in a week | Share |
|---|---|---|
| Backups compromised | 26% | |
| Backups protected | 46% |
Two further findings are worth paying attention to. Businesses whose backups were compromised were almost twice as likely to pay the ransom, 67% against 36%, and they paid 98% of the amount demanded on average, against 82% for those whose backups held. Negotiating position comes from having somewhere else to restore from. Our guide to how long ransomware recovery takes breaks down where those extra weeks go.
Why Backups Fail at the Worst Possible Moment
In the incidents our engineers work on, backup failure rarely traces back to the backup product. Instead, it traces back to how the backup system was connected to everything else.
| Failure mode | What goes wrong? |
|---|---|
| Shared administrator credentials | The backup server is joined to the domain and managed with the same privileged account as everything else. One compromised admin login grants an attacker access to production systems and backups in a single step. Sophos found that 79% of ransomware attacks in 2026 started with an identity-based approach, which makes this the most common path. |
| Repositories reachable from production | If a backup share is visible on the network, ransomware will encrypt it alongside the file server. Network-attached storage sitting in the same subnet is the classic example: convenient to restore from, equally convenient to destroy. |
| Retention shorter than dwell time | Attackers commonly remain within an environment for weeks before triggering encryption. If you keep 14 days of backups and the intrusion started 30 days ago, every restore point you hold may already contain the attacker's foothold. |
| Dormant infection in the backup set | Restoring a clean-looking server that carries the original malware puts you straight back where you started. This is how businesses get reinfected days after declaring recovery complete, and it’s why validation is a phase in its own right. |
| Jobs that report success but cannot restore | A completed backup job confirms data was written. It does not confirm that the data can be read back, that the database was quiesced properly, or that anyone knows the restore sequence. This gap only appears during an actual restore. |
| Cloud platforms assumed to be covered | Microsoft 365 keeps the service running and offers limited retention. It does not protect you from a malicious deletion discovered months later. See our Microsoft cloud services for where the platform's responsibility ends, and yours begins. |
“The worst calls we take are from businesses that did everything they thought they were supposed to. The jobs were green every morning for two years. Nobody had ever tried to restore from them, and the repository was sitting on the same domain as the servers that got encrypted.”Senior Infrastructure Engineer, CCS Horizon
What an Immutable Backup Really Means
An immutable backup cannot be modified or deleted for a defined retention period. Not by ransomware, not by a compromised administrator account, and not by the backup software itself. The storage layer refuses the instruction. That’s the whole point: it removes the attacker’s ability to act even after they have full control of your network.
The term covers several implementations, and the differences matter when you’re comparing quotes:
- Object lock in cloud storage. Amazon S3 and Azure equivalents can mark objects as write-once, read-many for a set period. Widely available and usually the most practical starting point for a small or mid-sized business.
- Hardened repositories. A backup repository running on a separate, non-domain-joined server with immutability enforced at the file system level, so domain credentials do not help an attacker.
- Tape and WORM media. Physically offline once written. Slower to restore from, and still the strongest guarantee available for long retention.
- Air-gapped copies. A copy with no network path back to production. Immutability and air-gapping solve the same problem from different directions, and larger environments often use both.
Immutability is why the classic 3-2-1 rule has been extended. The current version adds a fourth and fifth requirement: one copy offline, air-gapped, or immutable, and zero errors on verified restores. The second half of that is the part businesses skip.
Backup Compromise Success Rates Vary Sharply by Sector
Sophos also broke down how often attackers succeeded once they went after backups, and the spread is instructive.
| Sector | Success rate | Rate |
|---|---|---|
| Energy, oil, gas, utilities | 79% | |
| Education | 71% | |
| All sectors | 57% | |
| Retail | 47% | |
| IT, technology, telecoms | 30% |
IT and technology businesses resist backup compromise at less than half the rate of the worst-performing sectors, which tells you this is a solvable engineering problem rather than bad luck. Operationally sensitive environments sit at the other end. That pattern is consistent with what we see in manufacturing IT and medical IT work, where production and clinical systems cannot simply be switched off and rebuilt at leisure.
Six Questions That Reveal Whether Your Backups Would Survive
You do not need a full assessment to get a rough answer. Put these to whoever manages your IT and listen for hesitation.
- Can a domain administrator account delete our backups? If yes, then anyone who steals one can.
- When did we last complete a test restore, and what was restored? A date and a named system, or the answer is no.
- How far back do our restore points go? Compare that honestly against how long an intruder could have been present.
- Is any copy immutable or offline? If every copy is online and writable, you have one copy in security terms.
- Who is alerted when a backup job fails, and do they act? Alerts nobody reads are the same as no alerts.
- Do we have a documented restore order? Domain controllers, then databases, then applications. Working this out mid-incident costs days.
Any hesitation on these is worth investigating now rather than during an incident. Monitored, tested IT backup and recovery is a core part of our managed IT services, and all client backups and disaster recovery repositories are held in SOC 2-compliant data centers.
Detection Is Half of Backup Protection
Immutability protects the copies. It does nothing about the weeks an attacker spends inside your network deciding what to encrypt. Sophos found that 79% of 2026 ransomware attacks began with an identity-based approach, and that multi-factor authentication was missing where it mattered in 59% of investigated incidents, typically on VPNs, firewall consoles, and legacy applications rather than on email.
That is the practical argument for pairing backup work with monitoring. Unusual activity around backup jobs, new accounts appearing on the backup server, and repository deletions are all detectable events if somebody is watching. Our cybersecurity services and IT security services cover that side, and our guide to why businesses discover breaches too late explains how long that window usually stays open.
For regulated businesses, there’s a compliance dimension too. HIPAA, PCI DSS, and CMMC all expect you to be able to evidence that data can be recovered and that copies are properly controlled, which our IT compliance support covers in more detail.
Immutable Backup FAQs
The questions business owners and IT managers ask us most often about backup failure, immutability, and protecting recovery during an attack.
An immutable backup is a copy of your data that cannot be changed or deleted for a set retention period, enforced by the storage layer rather than by software permissions. Even an account with full administrative rights cannot remove it before the period expires. Common implementations include S3-style object lock, hardened non-domain-joined repositories, and write-once tape media.
Yes, and it is usually attempted. Sophos found that attackers tried to compromise backups in 94% of ransomware attacks and succeeded in 57% of those cases. Backups that are online, network-reachable, and managed with the same administrator credentials as production systems are the most vulnerable. Immutable and offline copies are the defense, because they cannot be deleted even with valid credentials.
The most common reasons are shared administrator credentials that give an attacker access to production and backups, repositories reachable from the production network, retention windows shorter than the attacker’s presence, malware dormant within the backup set, and restores that were never tested. Backup jobs reporting success confirm data was written, not that it can be read back and restored cleanly.
Quarterly is a reasonable minimum for most businesses, with critical systems tested more often. A test should restore a named system to a usable state and be documented with a date and outcome, so that you can evidence it to an auditor or insurer. If nobody can point to a successful restore in the last 90 days, treat your recovery capability as unproven.
It extends the older 3-2-1 rule. Keep three copies of your data, on two types of media, with one copy offsite, one copy offline or immutable, and zero errors on verified restores. The final two requirements are the modern additions, and they exist specifically because attackers target online backups and because untested backups fail at restore time.
For most small and mid-sized businesses, the difference is modest because object lock is a configuration option in cloud storage that many organizations are already paying for, rather than a separate product. Set against a median recovery cost that is eight times higher when backups are compromised, it is one of the cheapest risk-reduction options available. The bigger investment is usually the design work to separate backup credentials and network paths properly.
It depends entirely on how the repository is configured, not on the product. Veeam supports hardened repositories and object lock, so the capability is there, but a Veeam repository on a domain-joined Windows server with no immutability is still deletable by a stolen admin account. We support and monitor existing Veeam, Amazon S3, and Azure Blob repositories, and can add immutability and off-site replication where the current setup has gaps. See our IT backup and recovery and software support pages.
A structured review answers it faster than an audit of the documentation. Our free IT and security health check includes reviewing backup configuration, retention, and whether restores have been verified, alongside vulnerability scanning across the wider environment. It typically takes around two days of engineering work and produces a specific list of gaps in plain English. Check your backup and recovery readiness to get that picture.
Find out whether your backups would hold
If nobody can tell you the date of the last successful test restore, that is worth knowing before an attacker asks the question. CCS Horizon engineers will review your backup configuration, retention, and recovery position, and tell you plainly where the gaps are.
Article Sources
- Sophos. The impact of compromised backups on ransomware outcomes. Accessed September 9th, 2026.
- Sophos. The State of Ransomware 2026, seventh annual report. Accessed September 9th, 2026.
- Sophos. Nowhere, man: The 2026 Active Adversary Report. February 24th, 2026.
- Veeam. Ransomware Trends and Response Strategies Every Organization Needs to Know. August 11th, 2026.
- CISA. #StopRansomware Guide. Accessed September 9th, 2026.