When backups remain intact, ransomware becomes a recoverable problem. Attackers have recognized this vulnerability and are now systematically targeting backup systems, recovery points, and the infrastructure required to restore encrypted data. Eliminating the recovery option dramatically increases pressure on victims to pay. For IT leadership, the implication is stark: a backup offers protection only when attackers cannot reach it.

How backup-focused attacks unfold

ALPHV/BlackCat ransomware group

In February 2024, ALPHV/BlackCat breached Change Healthcare by exploiting a remote access portal that lacked multi-factor authentication. The organization's backups proved insufficient to enable rapid restoration. UnitedHealth Group paid $22 million in ransom yet never recovered its data, with total recovery costs reaching approximately $1.6 billion.

BlackMatter ransomware

BlackMatter made backup elimination a core part of their playbook. When attacking NEW Cooperative, an Iowa farm services company, and Crystal Valley, a Minnesota farm cooperative, in 2021, the group leveraged compromised administrator credentials to locate every backup data store and appliance, then wiped or reformatted them before encrypting the rest of the infrastructure. Because backups sat on the same network as production systems, they became easy targets. CISA, the FBI, and the NSA jointly documented this approach, noting ransom demands from this group have ranged from $80,000 to $15 million in Bitcoin and Monero.

Gunra ransomware

Gunra ransomware, detailed in a joint CISA and FBI advisory from August 2026, extended this strategy further. In one documented case, attackers removed backup and archived data from both the primary data center and the disaster recovery site. A single compromised credential granted access to both locations. Maintaining two copies across two separate sites provided no protection because both locations relied on the same authentication mechanism.

Rethinking backup strategy

These incidents reveal a fundamental shift in how organizations must approach backup planning. The traditional questions—how many copies exist and where are they stored—miss the critical issue. Instead, ask what systems connect those copies, who holds administrative authority over them, and whether a single compromised account could destroy all recovery copies.

Effective recovery planning must anticipate attacker attempts to eliminate the exit route. This means isolating critical backups from production environments, restricting administrative access, and ensuring no single compromised identity or pathway can wipe every recovery copy.

The financial stakes

The difference in cost between recovering with functional backups versus without them separates a manageable incident from an existential threat. IBM's 2025 Cost of a Data Breach Report documents an average ransomware incident cost of $5.08 million. Beyond direct financial loss, IBM's 2026 research shows 41% of ransomware incidents included threats to damage victim reputation, demonstrating how quickly impact spreads from operational disruption to eroded customer confidence.

When attackers destroy backups, they eliminate the leverage that allows organizations to refuse payment.

Why backup security remains weak

Backup-targeting attacks consistently exploit the same gaps. Recovery environments often exist but lack the security maturity applied to production systems.

  • Backups and production systems share network access and credentials: When the same administrator accounts manage both production and backup infrastructure, compromising one account may grant access to both. True separation requires deliberate design.
  • Backup software receives patches last: The Akira airline incident exploited a vulnerability with an available patch for over a year. Backup servers are frequently treated as appliances rather than active software systems, receiving updates last or not at all. Attackers monitor what remains unpatched.
  • Backup infrastructure receives minimal monitoring: Security teams focus detection and alerting on production systems. Backup servers typically have limited logging, weaker access controls, and slower incident response. Attackers operate in this quieter environment with less risk of detection.
  • Resource constraints create the deepest barrier: Understanding what good backup security requires and possessing the budget, trained personnel, and operational capacity to implement it are separate challenges. Many IT teams and managed service providers operate with insufficient resources across all three dimensions. They recognize the exposure but cannot close it quickly enough.

Building resilient backup security

Treating the recovery environment as critical infrastructure requires specific technical and operational changes.

  • Immutable storage as a baseline: Write-once backup copies that resist alteration or deletion—even by administrators—fundamentally shift the attacker's calculation. Most contemporary cloud storage platforms offer object lock capabilities that provide this protection. This is now a minimum requirement, not an advanced feature.
  • True network and credential isolation: A backup environment sharing network access and credentials with production is not genuinely separate. Proper isolation keeps backup data unreachable even after network compromise. Multi-factor authentication and role-based access controls for backup systems add friction that significantly slows attackers.
  • Patch backup software with production-level urgency: This demands discipline rather than new tools. Backup platforms must be explicitly incorporated into patch cycles rather than treated as exceptions.
  • Test restores, not just backups: An untested backup is merely an assumption. Regular restoration testing—ideally including attack scenario simulations—reveals gaps before attackers exploit them. Organizations discovering restoration failures during actual incidents have no opportunity to fix them.

The awareness-to-action gap

Backup security challenges reflect a broader cybersecurity problem. Most organizations understand attack risks and may recognize the need for stronger isolation, enhanced monitoring, or more robust recovery capabilities, yet lack the budget, personnel, or operational bandwidth to implement these protections.

Nearly 77% of IT organizations surveyed in a cybersecurity report indicate their security investment is not keeping pace with emerging threats. Among managed service providers, 65% report their clients are underinvesting in cybersecurity.

This creates a persistent tension. Security teams identify what requires attention, but constrained resources force prioritization decisions about where to focus effort first. Research drawing from responses by more than 1,100 IT and cybersecurity professionals examines the pressures driving these choices, including human error, underinvestment, staffing gaps, and operational friction.