Yes, your backup strategy is likely leaving you exposed to ransomware. The most common mistake is assuming that having any backup means you are protected, when in reality, backups that are not isolated, tested, or properly configured can be encrypted or deleted by the same attack they are meant to recover from. This article explains the specific backup failures that lead to ransomware recovery failure and how to fix them.
Formula
The calculator above estimates your total cost of a ransomware incident, combining the ransom demand (if paid) with the cost of restoring data from backups. The formula is:
Total Cost = Ransom Payment + (Cost per GB × Data to Restore)
Where:
- Ransom Payment (USD): The amount demanded by attackers, which may be zero if you refuse to pay.
- Cost per GB (USD): Includes labor, software, and hardware needed to restore one gigabyte of data.
- Data to Restore (GB): The total volume of data you need to recover from backups.
- Total Cost (USD): The sum of the ransom and restoration costs.
The second output, Cost per Day of Downtime, is a separate input field you can adjust to estimate lost productivity; it is not part of the formula but is shown for context.
Worked Example
Using the default values from the calculator:
- Ransom payment: $100,000
- Cost per GB to restore: $5
- Data to restore: 500 GB
Step 1: Multiply the cost per GB by the data volume: 5 × 500 = $2,500.
Step 2: Add the ransom payment: 100,000 + 2,500 = $102,500.
The calculator shows $102,500.00 as the total recovery cost. This example highlights that even without paying a ransom, restoration costs can be substantial.
Why Backups Fail Against Ransomware
Ransomware is designed to encrypt not only your live data but also any backup files it can reach. If your backup system is always connected to the network—such as an external drive plugged into a server, or a cloud sync folder that mirrors changes in real time—the malware can encrypt those copies too. A 2023 survey by Veeam found that 93% of ransomware attacks specifically target backup repositories, and 75% of those attacks succeed in damaging or deleting backups. The root cause is that most organizations treat backups as a convenience, not as a critical defense, and therefore fail to implement the isolation and testing that ransomware demands.
The 3-2-1 Rule and Its Ransomware Extension
The classic 3-2-1 backup rule states you should have three copies of your data, on two different media, with one copy offsite. This rule is a good starting point, but ransomware requires an extension: the 3-2-1-1-0 rule. The extra “1” means one copy must be immutable—it cannot be modified, deleted, or encrypted by anyone, including an attacker with admin credentials. The “0” means zero errors after a restore test. Immutability is achieved through technologies like Write Once Read Many (WORM) storage, object lock in cloud storage, or physically disconnecting a drive after the backup completes.
Common Backup Mistakes That Leave You Exposed
- Storing backups on the same network as production data—if the network is compromised, both are encrypted.
- Using a single backup copy—if that copy is corrupted or encrypted, you have nothing.
- Never testing restores—a backup that fails to restore is worthless; you only discover this when it is too late.
- Assuming cloud backups are immune—cloud sync services like Dropbox or Google Drive replicate changes, so an encrypted file on your computer becomes an encrypted file in the cloud.
- Ignoring backup logs—failed backups may go unnoticed for weeks, leaving you with an outdated or incomplete copy.
- Not protecting backup credentials—if attackers steal your backup login, they can delete the backups themselves.
How to Choose a Ransomware-Resilient Backup Solution
When evaluating backup products, look for these features:
- Immutable snapshots: Backups that cannot be altered or deleted for a set period, even by an administrator.
- Air-gapped or offline storage: A copy that is physically disconnected from the network, such as a tape or a drive that is unmounted after backup.
- Versioning: The ability to restore from multiple points in time, so you can roll back to a version before the encryption occurred.
- Malware detection: Some backup software scans for ransomware signatures and flags suspicious activity.
- Role-based access control: Limit who can delete or modify backups; use multi-factor authentication on backup accounts.
For small businesses, a practical approach is to have a local backup (external drive or NAS) that is disconnected after each backup, plus a cloud backup with versioning and object lock. For larger enterprises, dedicated backup appliances with immutable storage are the standard.
Testing Your Backups: The Only Way to Know
A backup is not a backup until you have successfully restored from it. Regular restore testing should be a scheduled task, not an afterthought. At minimum, perform a test restore of a critical file or folder monthly, and a full system restore quarterly. The test should simulate a real ransomware scenario: disconnect the network, restore from the backup, and verify that applications and data are intact. Document the restore time and any errors. If a restore fails, treat it as a critical incident and fix the backup system immediately. Many organizations are surprised to find their backups are unusable when they actually need them—don’t be one of them.
Cost of Ransomware vs. Cost of Backup
Ransomware attacks are expensive. The average total cost of a ransomware breach in 2023 was $1.85 million, according to IBM’s Cost of a Data Breach report. This includes business downtime, legal fees, customer notifications, and lost revenue—not just the ransom itself. In contrast, a robust backup solution costs a fraction of that: a cloud backup service for a small business might cost $50–$200 per month, and an on-premises NAS with immutable snapshots might cost $1,000–$5,000 upfront. The return on investment is clear: spending a few thousand dollars on backups can save you from a million-dollar incident. Even if you never face ransomware, backups are essential for hardware failures, accidental deletions, and natural disasters.
Frequently Asked Questions
Can ransomware encrypt my cloud backup?
Yes, if the cloud backup is a sync service that mirrors your files, or if the backup software uses credentials that the attacker can access. However, cloud backups with immutable object lock or versioning can protect against encryption—the attacker may encrypt the current version, but you can restore a previous version from before the attack.
How often should I test my backups?
At minimum, test a small restore monthly and a full system restore quarterly. More frequent testing is better if you have critical data. The goal is to ensure that the restore process works and that the restore time is acceptable for your business continuity plan.
What is an air-gapped backup?
An air-gapped backup is a copy of your data that is physically or logically isolated from the network, such as a tape stored in a safe or a drive that is disconnected after the backup job. This prevents ransomware from reaching it, because the malware cannot access a device that is not connected to the network.
Should I pay the ransom if my backups fail?
Law enforcement agencies, including the FBI, advise against paying ransoms. Paying encourages further attacks and does not guarantee you will get your data back—some attackers demand more money or never decrypt the files. If your backups are working, you do not need to pay. If they are not, you may have no choice, but it is a last resort with no guarantee.
Does the 3-2-1 rule still apply with ransomware?
Yes, but you need to extend it to 3-2-1-1-0: three copies, two media, one offsite, one immutable, and zero restore errors. The immutable copy is the key addition that protects against ransomware, because it cannot be altered even by an attacker with administrative privileges.