# Ransomware: a backup strategy that actually restores

URL: https://casterconsulting.hu/en/ransomware-backup-strategy/
Published: 2026-10-15
Updated: 2026-10-15
Author: Caster Consulting

> A backup is only worth something if you've tested the restore. Ransomware attackers now hunt for backups too, so at least one copy must be out of their reach, and recovery has to be practised regularly.

**Short answer: a backup is only worth something if you've tested the restore.** Ransomware attackers now hunt for backups too, and if they can reach them, they encrypt or delete them as well. So at least one copy must be out of their reach, and recovery has to be practised regularly. Most SMEs have backups. Far fewer have backups they could actually restore from on a Monday morning.

## How big is the threat?

ENISA, the EU's cybersecurity agency, called ransomware the most impactful threat in the EU in its 2025 threat landscape report. In the incidents it analysed, attackers got in through phishing in roughly 60% of cases.

Verizon's 2026 Data Breach Investigations Report found ransomware involved in 48% of breaches, with exploitation of vulnerabilities now the most common way in (31%).

Sophos's 2026 survey of 2,158 affected organisations in 17 countries found:

- data was encrypted in 56% of attacks, up from 50% a year earlier;
- of those whose data was encrypted, 66% restored from backups;
- 48% paid a ransom, with a median payment of $769,000;
- the average recovery cost was $1.7 million;
- **only 34% of companies with 100 to 250 employees stopped the attack before encryption**, against 46% of companies with 3,001 to 5,000.

That last number matters most for an SME: smaller companies spot attacks in time less often, so for them the backup is often the only way back.

## How an attack unfolds

A ransomware attack is rarely instantaneous. The typical sequence: the attacker gets in through a phishing email, a stolen password or an unpatched vulnerability. Then they spend days or weeks quietly mapping the network, gaining privileges, finding the backups and often copying data out. Only at the end do they encrypt, typically at a weekend or before a holiday, when the fewest people are watching.

Two things follow. Backups must reach back far enough to a time before the attacker got in. And the backup system must stand apart from the rest of the network, because attackers look for it deliberately.

## Why "we have backups" isn't enough

In Sophos's 2025 survey, recovery from backups fell to a six-year low of 54%. There are several reasons, all avoidable:

- **the backup sits on the same network,** and the attacker encrypts it too;
- **the backup is incomplete:** an important folder, a database or a cloud service was left out;
- **the backup is old or corrupted,** and that only shows during a restore;
- **nobody knows how to restore,** or how long it takes, and recovery drags on for days.

The US cybersecurity agency CISA explicitly warns that attackers deliberately seek out and delete accessible backups.

## The 3-2-1-1-0 rule

The classic 3-2-1 rule has been extended for the ransomware era:

- **3** copies of your data (the live data plus two backups);
- **2** different types of storage;
- **1** copy off-site (for example in the cloud or at another location);
- **1** copy offline, disconnected from the network, or on immutable storage that even an attacker can't delete or encrypt;
- **0** errors when you verify the restore.

The last two are what matter. The extra "1" protects the backup from the attacker, and the "0" ensures it's usable.

## What to back up, and how often

A backup plan starts with two numbers that management should set, not IT:

- **How much data can we afford to lose?** (RPO, recovery point objective.) If losing a day's work is acceptable, daily backups are enough. If only an hour, you need them more often.
- **How long can systems be down?** (RTO, recovery time objective.) If a day of downtime is serious damage, restores must happen within hours, and you need to have tested that.

Don't forget the cloud. Microsoft 365 or Google Workspace data, your CRM and your accounting system data are your data, and the provider won't necessarily protect you if someone deletes them from a compromised account.

## A typical SME backup setup

To make it concrete, a sensible setup for a 20 to 50-person company might look like this:

- **File server or shared storage:** hourly or daily snapshots on the server, daily backups to a separate backup device, and a weekly or daily copy to cloud storage with immutability switched on.
- **Business system, accounting, databases:** daily backups at database level, not just as files, because a file copy of a running database is often unusable.
- **Microsoft 365 or Google Workspace:** a separate backup service for email and documents, because the provider's recycle bin and version history don't replace a backup.
- **Laptops:** important files live in the company cloud, not only on the machine, so a lost or encrypted laptop doesn't mean lost data.
- **Retention:** several weeks of daily backups, because ransomware can lie dormant for days or weeks before encrypting.

For an SME this usually costs a fraction of what a day of downtime would. The exact setup depends on your systems, but the logic is the same everywhere: several copies, in several places, at least one out of the attacker's reach, and all of them tested.

## Testing the restore

CISA's guidance for small and medium businesses says backups should be tested regularly in a realistic recovery scenario. In practice:

- **monthly,** restore a randomly chosen file or folder;
- **quarterly,** restore a whole system (a server or a database) into an isolated environment and measure how long it took;
- **yearly,** run a tabletop exercise: who does what if everything is encrypted on Monday morning.

On our own servers we run daily local backups, off-site cloud backups and an automatic monthly restore test. Not because it's complicated, but because without it we wouldn't know the backup actually works.

## Five common mistakes

**"RAID is a backup."** It isn't. RAID protects against disk failure, not against deletion or encryption: if a file is encrypted, its mirrored copy is too.

**"A synced folder is a backup."** Also no. If ransomware encrypts the local file, syncing uploads the encrypted version to the cloud. Version history may help, but it doesn't replace a backup.

**Only one person knows how to restore.** If they're on holiday or unreachable, recovery slips by days. Write it down, and have at least two people practise it.

**Backup alerts reach nobody.** If a backup has been failing for weeks and nobody knows, the backup doesn't exist. You need a notification that someone actually reads.

**Nobody knows how long a restore takes.** Restoring several terabytes from the cloud can take days. Find that out in a test, not in a crisis.

## Questions to ask your IT partner

If an external partner runs your IT, five questions quickly show where your backups stand:

1. Which of our systems are backed up, how often, and where are the backups stored?
2. Is there an offline or immutable copy?
3. When was the last restore test, and how long did it take?
4. Does anyone get notified when a backup fails?
5. Is there a written plan for a ransomware attack, and who decides?

If any answer is vague, that alone is a task. A good partner answers these in minutes, with documentation.

## The cheapest preventive steps

Backups are the last line of defence. A few inexpensive steps mean you'll need them less often:

- **multi-factor authentication** on every account, especially email and remote access;
- **updates:** exploiting vulnerabilities is the most common way in, so systems must be patched regularly;
- **phishing awareness training:** most attacks start with an email;
- **least privilege:** not everyone should work with administrator rights;
- **separate credentials for the backup system:** backups shouldn't be reachable with the same password as the rest of the network.

## The first hour after discovery

What happens in the first hour often decides how bad the damage gets. Keep it simple and written down in advance: isolate affected machines from the network, but don't wipe or reinstall anything yet, because evidence and recovery options may be lost. Call the people on your list: your IT partner, management, and, if you have one, your cyber insurer, who may require specific steps. Note the time you discovered it, since reporting deadlines count from that moment. Only then start planning the restore, beginning with the systems the business needs first.

## Should you pay if it happens?

According to Sophos, 48% of affected organisations paid. But paying isn't a guarantee: not all data necessarily comes back, and nothing stops the attacker from returning. The best position is not having to decide, because you have a working, tested backup.

If it does happen: don't switch machines off in a panic; disconnect them from the network, call your IT partner, and check whether you need to report a data breach. If your company falls under NIS2, a significant incident must be reported to the authority within 24 hours.

## What to do now

1. **Agree with management** how much data loss and downtime are acceptable.
2. **Make an inventory:** which data lives where, including cloud services.
3. **Apply the 3-2-1-1-0 rule,** with at least one offline or immutable copy.
4. **Separate the backup** from the rest of the network, with its own credentials.
5. **Test restores** monthly with a file and quarterly with a whole system.
6. **Run a yearly tabletop exercise** with the team.
7. **Write down the emergency steps** on one page and keep them somewhere reachable during an attack, such as on paper or in a separate account.

If you'd like someone to assess your backups and set up regular restore testing, have a look at our [infrastructure and operations](/en/infrastructure/) service.

## FAQ

### Is backing up to the cloud enough?

Not always on its own. If the cloud backup is reachable with the account the attacker has taken over, they can delete it too. You need at least one offline or immutable copy with separate credentials.

### How often should we back up?

It depends on how much data loss is acceptable. If losing a day's work is manageable, daily backups are enough. If only a few hours, back up more often.

### How often should we test the restore?

A file or folder monthly, a whole system quarterly, and a tabletop exercise yearly. An untested backup is just hope.

### What is the 3-2-1-1-0 rule?

Three copies, on two different types of storage, one off-site, one offline or immutable, and zero errors when you verify the restore.

### Should we pay the ransom?

Ideally you never have to decide, because you have a tested backup. Paying doesn't guarantee all data comes back, and the attacker may return.

## Sources

- [Sophos – The State of Ransomware 2026](https://www.sophos.com/en-us/blog/sophos-state-of-ransomware-2026)
- [Sophos – Nearly Half of Companies Opt to Pay the Ransom (2025)](https://www.sophos.com/en-us/press/press-releases/2025/06/nearly-half-companies-opt-pay-ransom-sophos-report-finds)
- [ENISA – ETL 2025: EU consistently targeted by diverse yet convergent threat groups](https://www.enisa.europa.eu/news/etl-2025-eu-consistently-targeted-by-diverse-yet-convergent-threat-groups)
- [Verizon – 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/)
- [CISA – #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)
- [CISA – Back Up Business Data (small and medium businesses)](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/back-up-business-data)
- [Veeam – 3-2-1-1-0 Rule (best practices)](https://bp.veeam.com/vb365/guide/design/3-2-1)