Ahead of World Backup Day on 31 March, Sophos has highlighted the impact compromised backups can have on the outcomes of ransomware attacks.

If an organisation’s backup data is compromised as part of a ransomware attack, it leaves little room for negotiation. The only other way an operation can retrieve their data is through cooperation with the threat actors, often by paying a ransom.

Research also shows that paying out to ransomware criminals only leaves organisations more susceptible to future targeting, and it is also no guarantee that they will retrieve all their data.

Sophos surveyed 2,974 IT and cybersecurity professionals across many sectors whose organisations were hit by a ransomware attack in the last year.

In short, the impact of compromised backups is immense in terms of ransomware attacks. They essentially force a firm’s hand to pay out, and can result in the ultimate loss of encrypted data.

The research found that almost all (94%) of ransomware attackers tried to compromise backups as part of their assault.

For state and local government, as well as the media, leisure, and entertainment sector, the figure rose to 99%.

Even the sector with the lowest rate of attempted compromise – distribution and transport – still factored in at 82%.

Overall, 57% of backup compromise attacks were successful, but this ranged greatly across different industries, with energy and education facing the most successful attempts.

IT and telecoms and retail had the lowest rates, at 30% and 47% respectfully.

Impact 

The impact of a successful backup compromise can be devastating, as ransom demands and payments tend to double. The median ransom demand for those whose backups were compromised came in at $2.3m, with those with uncompromised backups ringing in at $1m.

Despite the rise in cost, those with compromised backups were almost twice as likely to pay the ransom than those whose backups remained safe.

Recommended reading

• Ransomware Attacks Up 73% in January 2024 Year-on-Year
• NCSC Warns Ransomware Threat to Rise with AI
• Ransomware Still Top Cyber-threat for SMBs

Further, organisations with compromised backups were 63% more likely to have their data encrypted than those with uncompromised backups.

Ransomware has other hidden costs, however, besides the actual ransom. Attacks can lead to outages, and often require expensive and complex IT system restoration.

Recovery from ransomware is eight times higher for those with compromised backups, with a median cost of $3m, and also incurs a longer recovery time.

This could be because it is difficult to restore decrypted data, or that less backup protection would mean weaker defences across the board.