Why ransomware goes after your backups
Ransomware encrypts your files and demands payment to unlock them. Attackers know that victims with good backups can simply restore, so once inside a network they often look for the backup system first and try to delete or encrypt it.
A backup sitting on the same network, reachable with the same admin account, can therefore be lost alongside the data it was meant to protect.
What the 3-2-1 rule means
3-2-1 is a simple, widely used framework for backup planning. Its aim is to make sure no single failure or attack can wipe out every copy at once.
- At least 3 copies of your data: the original plus 2 backups
- 2 different types of storage, such as a NAS and the cloud
- 1 copy kept off-site
Add an immutable or offline copy
These days the rule is often extended: at least one copy should be immutable or offline. An immutable backup can’t be deleted or overwritten during its retention period, even by an administrator. An offline copy might be a disconnected drive or tape.
That copy is the one safe point an attacker can’t reach, even with full control of your other systems.
Measures that work alongside backups
Backups help you recover; other controls make an attack less likely to succeed in the first place. Regular restore testing is the only real proof that your backups will work when it counts.
- Scheduled restore tests
- Multi-factor authentication on email, VPN and admin portals
- Prompt operating system and software patching
- A dedicated, separate admin account for the backup system
- Phishing awareness training for staff
What to do after an incident
Disconnect affected machines from the network straight away, but speak to a specialist before switching them off, as information in memory can help the investigation. Don’t start restoring until you’re confident the backups are clean, or you risk reinfecting your systems.
If personal data has been affected, review your notification obligations under KVKK, Turkey’s data protection law, with your legal adviser and keep a record of the incident.
Summary and how fountr can help
Solid protection comes from combining the 3-2-1 rule, an immutable copy, regular testing and basic security hygiene. We review your existing backup arrangements, close the gaps and put restore testing on a proper schedule. Call +90 535 100 71 41 or email [email protected].
