3-2-1 is not enough: 94% of ransomware victims saw attackers go for the backups

01What 3-2-1 says, and the two digits it now needs

Veeam’s current definition is the standard one: three copies of the data, counting the original; on two distinct kinds of storage; with at least one copy off-site. Veeam extends it to 3-2-1-1-0, adding “one immutable copy” and “zero recovery errors”, because “ransomware increasingly targets backups”.² The original three digits protect against independent failures: a disk dies, a building floods. The two new digits protect against a correlated one, an attacker with the keys to all three.

One correction to our 2024 post, which offered cloud storage as the easy way to meet the off-site rule. A folder synced to OneDrive, Google Drive or Dropbox is not a backup copy in this sense. Sync is designed to make every copy match, so when ransomware encrypts the local folder the encrypted files travel to the cloud too, and a deletion travels just as quickly. Version history helps, but only for as long as the service keeps it and only if the attacker has not used the same account to purge it. A backup copy is one the production system cannot overwrite.

02Attackers go for the backups first

Sophos asked 2,974 IT and security leaders whose organisations had been hit by ransomware in the previous year what happened to their backups. 94% said the attackers tried to compromise them; overall 57% of those attempts succeeded, ranging from 79% in energy and utilities to 30% in IT, technology and telecoms.¹ The outcomes then split sharply.

The money follows. Median ransom demands were US$2.3 million where backups were compromised and US$1 million where they were not, and median overall recovery costs were US$3 million against US$375,000.¹

These are self-reported medians from one vendor’s survey, and an organisation that loses its backups may differ in other ways too. But the direction is not in doubt, and it explains the attacker’s order of work: delete or encrypt the backups, then the servers, then send the note.

The mechanics are rarely clever. An operator who has spent days inside the network finds the backup server, its console and the credentials that run it, and then deletes the backups, shortens their retention so they expire, or encrypts the repository along with everything else.³ None of that needs a flaw in the backup software. It needs an administrator account that can do what administrators are normally allowed to do, which is why the next question is about permissions rather than features.

03Immutable is a word; who can lift the lock is the question

Almost every backup product now says “immutable”. TechBag’s cyber-recovery guide compares 15 products by SKU and records, from vendor documentation, who can remove the lock before the retention period ends. Two of the 15 are detection services with no storage of their own, which leaves 13.³

The middle bar is where buyers get caught. Acronis offers a compliance mode that nobody, including Acronis support, can override, but its default is governance mode, in which an administrator can disable immutability with a 14-day grace period. NinjaOne offers both modes on S3 Object Lock. Veeam’s own software leaves the repository and its immutability mode to your design.³ In each case the product supports a lock nobody can lift; whether you have one depends on a setting someone chose at installation.

Four questions settle it, and each answer should come from the vendor’s documentation page rather than its brochure:

1. Which lock mode is the default, and who switched it to the stricter one in our tenant?
2. Which role can shorten retention on an existing copy, and does that role exist in our directory today?
3. Is object lock actually enabled on the storage bucket, and on every bucket the backups write to, not only the first one someone configured?
4. Can the vendor’s support team delete a copy on request, and what proof of identity does that take?

04The zero: restoring clean, not just restoring

The final digit, zero errors, is usually read as “test your restores”. After ransomware it means more: the attacker was often inside for weeks, so the last several backups may carry the implant, and a restore that works can put it straight back. Three capabilities answer that, and the guide records each one by SKU.³

A clean room matters most to an organisation that cannot simply rebuild: a bank, a hospital, a manufacturer whose plant runs on the servers being restored. For a mid-sized services firm, a malware scan of the restore point and a scheduled test restore of one real server is the practical version of the zero. Whichever applies, the 2024 post’s advice to “test your backups” needs a date in the calendar and a named owner to mean anything.