---
title: "3-2-1 is not enough: 94% of ransomware victims saw attackers go for the backups"
summary: "Sophos's survey of 2,974 ransomware victims and TechBag's count of 15 cyber-recovery products: who can lift the lock and who restores clean, as of September 2026."
url: https://www.thetechbag.com/blog/321-backup-rule-essential-data-protection
format: Analysis
desk: "Data & privacy"
published: 2026-05-19
facts_checked: 2026-09-30
author: TechBag (The TechBag Journal)
tags: ["3-2-1 backup rule","3-2-1-1-0","immutable backup","ransomware","Sophos","Veeam","cyber recovery","object lock","DPDP","CERT-In"]
cover: https://www.thetechbag.com/blog/covers/321-backup-rule-essential-data-protection.png
---

# 3-2-1 is not enough: 94% of ransomware victims saw attackers go for the backups

*Sophos's survey of 2,974 ransomware victims and TechBag's count of 15 cyber-recovery products: who can lift the lock and who restores clean, as of September 2026.*

Analysis · Data & privacy · By TechBag · Published 2026-05-19 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/321-backup-rule-essential-data-protection

The short version

- The 3-2-1 rule still holds: three copies, two kinds of storage, one off-site. It was written for failed disks and fires, though, and in Sophos’s 2024 survey ransomware operators tried to compromise the backups in 94% of attacks and succeeded in 57%.[1]
- Where the backups fell, median recovery cost was US$3 million against US$375,000 where they survived, eight times as much, and victims paid the ransom almost twice as often.[1]
- The fix is the extra “1” in 3-2-1-1-0: a copy no single administrator can delete. Of 13 storage products in TechBag’s cyber-recovery guide, 6 document that nobody can lift the lock inside retention.[3]

The question our 2024 post answered was what the 3-2-1 rule is. The question a buyer has now is whether following it is enough. An organisation can keep three copies on two media with one off-site and still lose all three in an afternoon, if the same stolen administrator account can reach every one of them. That is how most modern ransomware ends, and it changes what the rule needs to say.

## What 3-2-1 says, and the two digits it now needs

Veeam’s current definition is the standard one: three copies of the data, counting the original; on two distinct kinds of storage; with at least one copy off-site. Veeam extends it to 3-2-1-1-0, adding “one immutable copy” and “zero recovery errors”, because “ransomware increasingly targets backups”.[2] The original three digits protect against independent failures: a disk dies, a building floods. The two new digits protect against a correlated one, an attacker with the keys to all three.

**Figure: 3-2-1 survives fire and disk failure; the extra 1 and 0 are what survive an attacker**

*The 3-2-1 rule and its 3-2-1-1-0 extension, as defined by Veeam*

1. 013 copiesThe original plus at least two backups, so one corrupt copy is not the end.
2. 022 kinds of storageDisk and cloud, or disk and tape, so one media fault cannot take both.
3. 031 off-siteAnother building or region, so a fire or flood leaves a copy standing.
4. 04+1 immutable, 0 errorsOne copy nobody can change or delete, and restores tested until they come back clean.

Source: Veeam, What is the 3-2-1 backup rule (dated 5 February 2024, updated 3 July 2026) · as of 3 July 2026

Our view

Our view: the off-site copy and the immutable copy can be the same copy, and for most mid-sized Indian organisations they should be. What matters is that the credentials which run your production backups cannot shorten or delete it.

One correction to our 2024 post, which offered cloud storage as the easy way to meet the off-site rule. A folder synced to OneDrive, Google Drive or Dropbox is not a backup copy in this sense. Sync is designed to make every copy match, so when ransomware encrypts the local folder the encrypted files travel to the cloud too, and a deletion travels just as quickly. Version history helps, but only for as long as the service keeps it and only if the attacker has not used the same account to purge it. A backup copy is one the production system cannot overwrite.

## Attackers go for the backups first

Sophos asked 2,974 IT and security leaders whose organisations had been hit by ransomware in the previous year what happened to their backups. 94% said the attackers tried to compromise them; overall 57% of those attempts succeeded, ranging from 79% in energy and utilities to 30% in IT, technology and telecoms.[1] The outcomes then split sharply.

**Figure: When backups fell, victims paid nearly twice as often and fewer recovered within a week**

*Share of ransomware victims, by whether backups were compromised, survey conducted early 2024*

|  | Backups not compromised | Backups compromised | Change |
| --- | --- | --- | --- |
| Data encrypted | 52 | 85 | 33 pts |
| Paid the ransom | 36 | 67 | 31 pts |
| Fully recovered in a week | 46 | 26 | -20 pts |

Source: Sophos, The Impact of Compromised Backups on Ransomware Outcomes (n = 2,974) · as of 28 March 2024 · survey of victims, self-reported; association, not causal

The money follows. Median ransom demands were US$2.3 million where backups were compromised and US$1 million where they were not, and median overall recovery costs were US$3 million against US$375,000.[1]

8×

median recovery cost where backups were compromised

US$3 million against US$375,000 where they survived; Sophos survey of 2,974 ransomware victims.

These are self-reported medians from one vendor’s survey, and an organisation that loses its backups may differ in other ways too. But the direction is not in doubt, and it explains the attacker’s order of work: delete or encrypt the backups, then the servers, then send the note.

The mechanics are rarely clever. An operator who has spent days inside the network finds the backup server, its console and the credentials that run it, and then deletes the backups, shortens their retention so they expire, or encrypts the repository along with everything else.[3] None of that needs a flaw in the backup software. It needs an administrator account that can do what administrators are normally allowed to do, which is why the next question is about permissions rather than features.

## Immutable is a word; who can lift the lock is the question

Almost every backup product now says “immutable”. TechBag’s cyber-recovery guide compares 15 products by SKU and records, from vendor documentation, who can remove the lock before the retention period ends. Two of the 15 are detection services with no storage of their own, which leaves 13.[3]

**Figure: Only 6 of 13 immutable backup products document that nobody can lift the lock inside retention**

*Storage products by who can remove immutability before retention ends, of 13 in TechBag's Cyber Recovery guide, September 2026*

Nobody, inside retention

Veeam Vault, Commvault (two), FortKnox, Alta, Druva

6 products

Two people or vendor support

Rubrik (two), Cohesity DataLock

3 products

Depends on the mode you chose

Veeam Premium, Acronis, NinjaOne

3 products

Not established

Barracuda

1 products

|  | Value (products) |
| --- | --- |
| Nobody, inside retention | 6 |
| Two people or vendor support | 3 |
| Depends on the mode you chose | 3 |
| Not established | 1 |

Source: TechBag Cyber Recovery guide, from vendor documentation · as of 30 September 2026 · vendor documentation verified 22 August 2026; 'not established' is never read as a fail

The middle bar is where buyers get caught. Acronis offers a compliance mode that nobody, including Acronis support, can override, but its default is governance mode, in which an administrator can disable immutability with a 14-day grace period. NinjaOne offers both modes on S3 Object Lock. Veeam’s own software leaves the repository and its immutability mode to your design.[3] In each case the product supports a lock nobody can lift; whether you have one depends on a setting someone chose at installation.

Four questions settle it, and each answer should come from the vendor’s documentation page rather than its brochure:

1. **Which lock mode is the default,** and who switched it to the stricter one in our tenant?
2. **Which role can shorten retention** on an existing copy, and does that role exist in our directory today?
3. **Is object lock actually enabled on the storage bucket,** and on every bucket the backups write to, not only the first one someone configured?
4. **Can the vendor’s support team delete a copy** on request, and what proof of identity does that take?

TechBag countHow TechBag counted

Each product’s “who can lift” value is the guide’s field as committed on 30 September 2026. The six “nobody” products are Veeam Data Cloud Vault, Commvault Air Gap Protect, Commvault Cleanroom Recovery, Cohesity FortKnox, Veritas Alta Recovery Vault and Druva’s cyber-resilience tier. Commvault ThreatWise and Rubrik Threat Hunting are excluded as detection services. Only one of the 13, Veeam’s Premium edition, documents an offline or tape copy as well as a logical air gap.

## The zero: restoring clean, not just restoring

The final digit, zero errors, is usually read as “test your restores”. After ransomware it means more: the attacker was often inside for weeks, so the last several backups may carry the implant, and a restore that works can put it straight back. Three capabilities answer that, and the guide records each one by SKU.[3]

**Figure: Fewer than half the cyber-recovery products scan backups for malware, and 3 of 15 offer a clean room**

*Products documenting each restore-clean capability, of 15 in TechBag's Cyber Recovery guide, September 2026*

Scans backups to build a clean restore point

7 products

Detects anomalies or encryption in the data

6 products

Isolated clean room to restore into

Veeam Premium, Commvault Cleanroom, Rubrik

3 products

|  | Value (products) |
| --- | --- |
| Scans backups to build a clean restore point | 7 |
| Detects anomalies or encryption in the data | 6 |
| Isolated clean room to restore into | 3 |

Source: TechBag Cyber Recovery guide, from vendor documentation · as of 30 September 2026

A clean room matters most to an organisation that cannot simply rebuild: a bank, a hospital, a manufacturer whose plant runs on the servers being restored. For a mid-sized services firm, a malware scan of the restore point and a scheduled test restore of one real server is the practical version of the zero. Whichever applies, the 2024 post’s advice to “test your backups” needs a date in the calendar and a named owner to mean anything.

If you are buying this in India

Immutable cloud storage is priced per terabyte in US dollars and invoiced in rupees through a reseller with 18% GST. Veeam Data Cloud Vault lists at US$14 a TB a month on its Foundation tier and US$24 on Advanced, with an India Central region; for 10 TB that is US$1,680 a year before tax on Foundation. Of the 15 products in the guide, 4 document an Indian region for the immutable copy: Veeam Vault, Commvault Air Gap Protect, Druva on AWS Mumbai and Acronis in its Mumbai data centre.[3] Residency across the wider backup market is covered in our [multi-cloud backup piece](https://www.thetechbag.com/blog/simplify-multi-cloud-data-management-deep-dive).

Three obligations make this concrete. CERT-In’s Directions of 28 April 2022 list ransomware among the incidents that must be reported within six hours.[4] Rule 6 of the DPDP Rules, notified on 13 November 2025, names data backups among the reasonable safeguards for continued processing when data is compromised, with the substantive duties in force from 13 May 2027.[5][6] Banks answer to RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026, and SEBI-regulated entities to the CSCRF, in force since 31 August 2025.[7][8]

How we did this

Figures as of 30 September 2026

The survey figures are Sophos’s, from 2,974 respondents hit by ransomware in the year before an early-2024 survey run by Vanson Bourne; they are self-reported medians and percentages, and the chart shows association, not cause. The product counts are TechBag’s Cyber Recovery guide as committed on 30 September 2026, with each field taken from vendor technical documentation verified on 22 August 2026; a value marked not established was not counted as a fail. The 3-2-1-1-0 definition is Veeam’s. The 10 TB example is list price multiplied out, before GST and any reseller discount.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Sophos, The Impact of Compromised Backups on Ransomware Outcomes (survey of 2,974 ransomware victims, Vanson Bourne)](https://www.sophos.com/en-us/blog/the-impact-of-compromised-backups-on-ransomware-outcomes/) — 28 March 2024
2. [Veeam, What is the 3-2-1 backup rule? (and 3-2-1-1-0)](https://www.veeam.com/blog/321-backup-rule.html) — 5 February 2024; updated 3 July 2026
3. [TechBag, Cyber Recovery guide: 15 products by immutability, who can lift it, air gap, clean room, India and price](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — version committed 30 September 2026; vendor documentation verified 22 August 2026
4. [CERT-In, Directions under section 70B(6) of the IT Act, Annexure I (ransomware among reportable incidents; six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022
5. [DPDP Rules, 2025, Rule 6 (reasonable security safeguards, including data backups)](https://dpdpa.com/dpdparules/rule6.html) — notified 13 November 2025
6. [MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (substantive duties from 13 May 2027)](https://www.meity.gov.in/data-protection-framework) — 13 November 2025
7. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched.
8. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025 Not re-fetched for this piece.

Related on TechBag: the [Cyber Recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) filters the 15 products on exactly these questions, and the [Backup & Recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) covers the platforms underneath.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [Cyber recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — 15 products by who can lift the lock, air gap, clean room and India
- [Backup & recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) — the platforms the immutable copy sits behind
- [Veeam Data Cloud Vault](https://www.thetechbag.com/veeam/veeam-data-cloud-vault) — always-on immutable storage with an India Central region