Problems We Solve
Ransomware That Encrypts Backups Too: Why Connected Backups Are Not Enough
The Challenge
Modern ransomware does not just target live business data, it actively searches for connected backup drives, mapped network shares, and backup software on the same network and encrypts or deletes those copies as well. A business that believed it was protected because a backup drive was plugged in or a backup folder existed on the same server can discover, during an actual attack, that both the original files and the backup were encrypted together. This turns what should have been a recoverable incident into a total loss scenario, where the only remaining options are paying a ransom with no guarantee of recovery, or rebuilding from scratch. Backup alone is not protection against ransomware unless it is isolated from the systems it protects.
Why This Happens
Ransomware is designed to spread across a network and locate anything that looks like a backup, because attackers know that a business with an intact backup has no reason to pay a ransom. If a backup drive is continuously connected to a computer or server, or if backup files sit on a shared network drive with standard write access, the ransomware can reach and encrypt them using the same permissions it used to compromise the original data. Many backup setups are built for convenience, with the backup destination always accessible so the process can run automatically, but that same accessibility is exactly what allows ransomware to treat the backup as just another target rather than a safeguard.
The Risk to Your Business
When both live data and its backup are encrypted in the same attack, a business loses its ability to recover without paying the attackers, and even paying does not guarantee that files will be returned intact or at all. Operations can be halted for days or weeks while systems are rebuilt from whatever remains, and any data that existed only on the compromised systems may be permanently lost. Beyond the immediate disruption, a business may face client notification obligations, reputational damage, and the ongoing risk of repeat attacks if the underlying vulnerability that allowed the ransomware in is not addressed. The absence of an isolated, unreachable backup removes the one option that would otherwise make a ransomware attack survivable without paying anything.
How Cobham Tech Solves It
Cobham Tech designs backup systems with isolation in mind, so that backup copies are not directly reachable by ransomware that compromises the live network. This includes offline, air-gapped, or immutable backup storage that cannot be altered or deleted even by an attacker with administrative access to the primary systems, along with cybersecurity measures that reduce the chance of ransomware reaching the network in the first place. If an attack does occur, Cobham Tech's data recovery services can restore business systems from a clean, unaffected backup instead of relying on negotiation with attackers. This combined approach gives businesses across the Cobham Tech service area a genuine recovery path that does not depend on paying a ransom.
Related Cobham Tech Resources
Further Reading
Free Consultation
Talk to a Local IT Expert
Tell us about your business and we will follow up within one business day with a straight answer on how we can help.