Will Ransomware Encrypt My Backups?

Yes, ransomware can encrypt your backups if they are accessible from the infected system. The key to protecting backups is to make them inaccessible to the ransomware, typically by using offline or immutable storage.

Formula

The backup infection risk score is a rough indicator of how vulnerable your backup strategy is to ransomware. It is calculated as:

Risk = (Backup interval × Detection time) / (Number of copies × 100)

• Backup interval (t) – how often backups are made, in days.
• Detection time (r) – how long ransomware could lurk before you notice, in days.
• Number of copies (n) – how many separate backup copies you keep.

A higher score means greater risk. The formula assumes all backups are equally accessible and not isolated. It does not account for offline or immutable storage.

Worked Example

Using the defaults: backup every 7 days, detection time 30 days, and 3 copies.

Risk = (7 × 30) / (3 × 100) = 210 / 300 = 0.70

The score is 0.70 on a scale where lower is better. This suggests moderate risk – the backups are frequent enough, but if ransomware goes unnoticed for a month, it could encrypt the most recent copies if they are connected.

How Ransomware Finds Your Backups

Ransomware doesn’t just encrypt files on the local drive. It scans for any connected storage: external USB drives, network shares, mapped drives, and even cloud sync folders. Many strains specifically search for backup software folders and file extensions like .bak, .vhd, or .vbk. Once found, they encrypt those files too, so you can’t restore.

Modern ransomware often runs with the same user permissions as you. If you can write to a backup location, so can the malware. It may also delete shadow copies (Windows Volume Shadow Copies) to prevent recovery.

Why Offline Backups Are Safe

An offline backup is one that is not connected to the network or the computer when not in use. For example, an external hard drive that you unplug after each backup. Ransomware cannot encrypt what it cannot reach. This is the simplest and most reliable protection.

However, offline backups require discipline. You must remember to plug in the drive, run the backup, and unplug it again. If the drive stays connected, it is effectively online and vulnerable.

Immutable and Versioned Backups

Cloud backup services often offer immutable storage, where files cannot be changed or deleted for a set period (e.g., 30 days). Even if ransomware gets your cloud credentials, it cannot modify or erase the protected versions.

Versioning is also crucial. If your backup software keeps multiple versions of files, you can roll back to a version before the infection. But if ransomware encrypts all versions, you are out of luck. Immutability prevents that.

Common Mistakes That Expose Backups

• Leaving external drives plugged in – they become just another drive to encrypt.
• Using the same credentials for backup and daily use – if your account is compromised, so are the backups.
• Only having one backup copy – if it fails, you have nothing.
• Not testing restores – a backup that cannot be restored is worthless.
• Assuming cloud sync (like Dropbox) is a backup – sync replicates ransomware to all devices.

How to Protect Your Backups

1. Follow the 3-2-1 rule: at least 3 copies, on 2 different media, with 1 copy offsite and offline.
2. Use immutable storage if your cloud provider offers it.
3. Keep backup credentials separate and use multi-factor authentication.
4. Disconnect external drives after backup.
5. Regularly test restores to ensure data is intact.

What to Do If Backups Are Encrypted

If you discover that your backups are also encrypted, do not panic. Check if you have any offline copies or older versions that were not affected. If you have immutable backups, you can restore from them. If not, you may need to contact a data recovery professional, but success is not guaranteed. The best defense is prevention.

Frequently Asked Questions

Can ransomware encrypt cloud backups?

Yes, if the cloud backup is continuously connected and the ransomware has your credentials. However, many cloud services offer versioning or immutable storage that can protect you. Always enable these features.

Does disconnecting a drive really help?

Yes. Ransomware cannot encrypt a drive that is not connected. This is why offline backups are considered the gold standard for protection.

Should I use a NAS for backups?

A NAS is convenient, but it is always connected, so it is vulnerable. If you use a NAS, make sure it supports snapshots or immutable backups, and do not mount it permanently on your computer.

How often should I test my backups?

At least monthly, and after any major system change. A restore test ensures your backups are not corrupted and that you know how to restore.

Can ransomware delete shadow copies?

Yes, many ransomware strains specifically delete Volume Shadow Copies to prevent recovery. This is why you should not rely solely on Windows System Restore.

Is a second local drive enough?

No, because if it is always connected, ransomware can encrypt it. You need at least one backup that is offline or offsite.

Related

• Beat Link’s Awakening Without Missing Key Items
• WordPress.com Plans: Which Fits Your Site?
• Shader Stutter vs Network Lag: How to Tell

in t | Backup interval (days) | days | 7 | 1 | 365
in r | Ransomware detection time (days) | days | 30 | 1 | 365
in n | Number of backup copies | - | 3 | 1 | 10
out risk | Backup infection risk score | - | (t * r) / (n * 100) | 2