Backups wont save you from this version of ransomware

Date:
Mon, 06 Apr 2026 14:03:06 +0000

Description:
While backups continue to be essential, they no longer determine preparedness when attackers steal sensitive data and use exposure as the primary pressure point.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Pro Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Become a Member in Seconds Unlock instant access to exclusive member features. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are
now subscribed Your newsletter sign-up was successful Join the club Get full access to premium articles, exclusive features and a growing list of member rewards. Explore An account already exists for this email address, please log in. Subscribe to our newsletter For years, the ransomware conversation has followed a familiar script. Systems go down. Files are encrypted. Operations stall. Executives ask whether the company can restore from backup or whether it has to pay.

That scenario still happens. But an industry wide report published last month suggests the threat has divided into parallel tracks. Josh Taylor Social
Links Navigation

Lead Cybersecurity Analyst at Fortra. The report, drew from hundreds of real-world incident response engagements, found that data-only extortion incidents surged eleven times year over year, growing from 2% to 22% of
cases. Article continues below You may like British businesses still arent bouncing back from cyberattacks heres how to tackle the problem When confidence becomes a risk: The gap between cyber resilience readiness and reality AI is breaking the prevention first mindset: Why rapid recovery now matters more than ever

Verizons 2025 Data Breach Investigations Report reflects this broader evolution by treating ransomware with or without encryption as part of the same extortion landscape, noting that ransomware appeared in 44% of breaches it reviewed. Rethinking how companies define resilience This should force a rethink in how companies define resilience. Too many organizations still approach ransomware as if it were primarily an operational recovery problem. The key question becomes how quickly systems can be restored, whether backups are isolated, and how much downtime the business can tolerate.

Those are still important questions. They are just no longer sufficient. It begins once attackers shift from availability loss to confidentiality loss, the entire decision model changes.

The immediate questions are no longer only technical. What data was taken?
Who owns it? Was it a customer database , regulated data, intellectual property, internal communications, or some mix of all of the above? Was it stored in a core environment, duplicated in SaaS platforms, shared with a vendor, or retained years longer than necessary? Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

If leadership cannot answer those questions quickly, it may recover systems but still fail to mitigate the larger fallout .

Recent reporting from Coveware underscores why this shift matters. In its Q2 2025 ransomware analysis, exfiltration appeared in 74% of cases, and the firm described data theft as the main event in many attacks rather than merely a precursor to encryption.

Threat actors are optimizing for pressure, not just disruption. The data itself has become the hostage. What to read next Regulatory whiplash: Why cyber resilience is now a governance imperative Im a backup and recovery provider, but heres why you shouldnt just trust me The four shifts reshaping Microsoft 365 security and resilience Double extortion remains part of the playbook This does not mean encryption has disappeared from ransomware. In many double extortion campaigns, it remains a core part of the playbook. The point is that theft of sensitive data now often carries enough leverage on
its own that backups, while still essential, no longer define preparedness.

This makes the old backup -centric story increasingly incomplete. Backups remain essential. CISA continues to emphasize them, especially offline and tested recovery copies, while also warning that automated cloud backups can
be insufficient if encrypted files sync back into the environment and overwrite clean versions. But that guidance points to a broader truth.

That restoration is only one part of resilience. This is also where the
market is quietly catching up to the threat. It is not accidental that more
of the security industry is emphasizing data protection and data visibility rather than treating ransomware purely as a recovery problem.

That shift reflects a broader reality: organizations are realizing that resilience is no longer just about restoring systems after disruption. It is about reducing uncertainty around data exposure before a crisis forces the question. The single lens of disaster recovery That idea deserves more attention in board rooms, security war rooms and with clients. Many enterprises have been taught to view ransomware readiness through the single lens of disaster recovery. Many MSPs still package it in this way as well.
The language centers on data recovery time objectives, backup testing, and business continuity.

But in a data theft-led extortion model, the more revealing measure of maturity is whether an organization actually knows where its sensitive data lives, how it moves, who has access to it, and whether it should still exist at all. NISTs Cybersecurity Framework 2.0 points in that direction.

Its implementation examples explicitly call for maintaining inventories of designated data types and corresponding metadata, including provenance, data owner, and geolocation.

It also ties lifecycle management to reducing unnecessary exposure, including securely destroying stored data based on retention policy and identifying redundant systems and services that increase attack surface. NISTs current incident response guidance makes the point even more directly.

It states that data inventories including classifications, owners, and
logical and physical locations provide valuable information on what data may have been involved in an incident. That is exactly the problem many organizations discover too late. Understanding the true data attack surface This is where ransomware, privacy , governance, and business strategy
collapse into the same event. A single intrusion can become an operational disruption, a legal problem, a customer trust crisis, a regulatory reporting exercise, and a competitive exposure issue all at once.

That is why the old question, Do we have backups? now feels too narrow. The harder and more useful question is whether the company understands its true data attack surface before the intrusion happens. There is also a deeper organizational issue here.

Many enterprises have improved recovery architecture while allowing data sprawl to worsen. Sensitive files are copied across collaboration platforms, cloud repositories, shared drives, unmanaged endpoints, and third-party systems. Legacy data remains because no one wants to own deletion decisions.

Access accumulates faster than it is reviewed. In that environment, a company may look resilient on paper while quietly carrying enormous extortion
leverage inside its own estate. The strategic lesson The strategic lesson is not that backups matter less. It is that backups solve a different problem. They help recover systems. They do not restore secrecy, trust, or negotiating position once data has been taken. In the extortion era, resilience has to become more data-centric.

That means better classification, tighter identity management controls around high-value repositories, stronger visibility across cloud and third-party environments, and more disciplined retention practices so attackers have less to steal in the first place. It also means more honest conversations with clients and boards about the difference between operational recovery and genuine resilience.

The companies that navigate this best will not be the ones with the fastest recovery time. They will be the ones that never had to guess what was taken. Backups are infrastructure. Understanding your data is strategy. In the current threat environment, the gap between those two things is exactly where extortion lives. Read our list of the best data recovery services.



======================================================================
Link to news story: https://www.techradar.com/pro/backups-wont-save-you-from-this-version-of-ranso mware


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)