SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-ransomware-hits-backups

What do many ransomware variants try to do to backups they can reach?

Delete or encrypt them.

Start playing free

  1. Copy them quietly
  2. Move them to the cloud
  3. Delete or encrypt them ✔

Why: Attackers know you may restore from backups instead of paying. If your backup drive is plugged in or a shared folder, it can be locked too. Keep one copy disconnected.

Huh, didn't know that: NCSC says incidents involving ransomware have also compromised connected cloud storage locations containing backups.

The dad joke
Why don't photocopiers ever lie? They're always making copies.
Like this card?
Play the game

References

Answer: Delete or encrypt them. Attackers know you may restore from backups instead of paying. If your backup drive is plugged in or a shared folder, it can be locked too. Keep one copy disconnected.

  1. CISA: #StopRansomware Guide www.cisa.gov/stopransomware/ransomware-guide
    many ransomware variants attempt to find and subsequently delete or encrypt accessible backups
    Checked 2026-10-10.
  2. NCSC: Offline backups in an online world www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world
    Incidents involving ransomware have also compromised connected cloud storage locations containing backups.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyCISA says to keep which kind of backups of critical data?Security & PrivacyWhat should you do regularly with your backups, according to CISA?Security & PrivacyWhat does NCSC say to turn on to protect your online backups?

That's stuff everyone should know.