Ransomware is far less frightening when you know you can recover.
That’s why threat actors are turning their attention to encrypting backups. They wipe recovery points and disrupt the infrastructure needed to restore the encrypted data. Once that recovery path disappears, the pressure to pay rises sharply.
For IT leaders, the lesson is uncomfortable but simple. A backup is only a safety net if the attacker cannot reach it.
What attacks on backup infrastructure look like
Ransomware groups have found several ways to neutralize backups, and the methods keep getting more deliberate.
ALPHV/BlackCat ransomware group
In February 2024, the ALPHV/BlackCat ransomware group encrypted Change Healthcare’s systems after breaking through a remote access portal with no multi-factor authentication. The backups were not isolated or robust enough to restore operations quickly.
UnitedHealth paid $22 million in ransom and still did not get its data back. Total recovery costs hit an estimated $1.6 billion.