If your whole ransomware plan is "we have backups", a modern crew has already planned around it — here's what actually stops the bleeding.
Modern ransomware gangs assume you have backups — that's exactly why they steal a copy of your data first. The old picture of ransomware was simple: your files get scrambled, you restore from last night's backup, you're back in business by lunch. That picture is years out of date. Today's crews treat your backups as an obstacle to remove on the way in, and your data as a second hostage they can sell or leak whether or not you ever pay to unlock a single file.
How does double extortion ransomware work?
Double extortion ransomware is an attack where criminals copy your data out before they encrypt your systems, so they can demand payment twice: once to unlock your files, and again to stop them leaking or selling what they took. It is now the default rather than the exception. The attacker quietly exfiltrates client records, financials, contracts and mailboxes, and only then triggers the encryption. Restoring from backup answers the first threat. It does nothing about the second.
Take Qilin, one of the most active ransomware operations through 2025 and into 2026. Security researchers and reporting outlets attributed more than a thousand victims to the group over the past year, and noted it leaned heavily on small and medium businesses. The reason crews like this favour SMBs is uncomfortable but simple: smaller teams tend to have flatter networks, thinner monitoring, and backups sitting on the same domain as everything else — which is precisely what an affiliate wants. If you've been counting on being too small to be a target, that logic runs the other way.
Why aren't backups enough to stop ransomware?
Backups aren't enough because modern crews delete or encrypt every backup they can reach, and steal your data before encryption starts, so even a perfect restore can't undo the leak. Affiliates following this playbook do three things before you ever see a ransom note, and each one undercuts the "we're fine, we have backups" assumption:
They hunt your backups first
Once inside, attackers map the network looking for backup servers, cloud backup credentials and snapshot tools — then delete or encrypt them so you can't restore. Backups reachable with a normal admin login are the first thing to go.
They harvest credentials and move laterally
Stolen passwords let them spread quietly from one machine to the whole estate, often over days or weeks. Traditional antivirus usually sees nothing during this phase. The way in is often a staff password reused from a breach at some other website, and a free dark web scan shows whether your business email addresses have already turned up in one.
They exfiltrate your data
Gigabytes leave the building before encryption starts. Even a flawless restore can't un-leak data that's already on a criminal's server.
So the honest version of the question isn't "do we have backups?" It's "are our backups out of reach of an attacker who already has domain admin — and would we even notice the theft and the deletion before the encryption?"
How do you protect backups from ransomware?
You protect backups from ransomware by keeping immutable copies plus at least one copy offsite, because a backup only counts if the attacker can't tamper with it. Immutable backups are written so they cannot be altered or deleted for a set retention period, even by someone holding your administrator credentials, and the offsite copy sits in a separate security boundary from your production environment. If your backup can be wiped with the same login that runs your file server, it's a convenience feature, not a safety net.
This is the difference between a bad week and a closed business, and it's the backbone of a proper disaster recovery and business continuity setup. It's also why, for medical clinics on Best Practice, Key IT runs the software's own backup alongside a separate immutable copy, and for dental practices it keeps an immutable copy of the Dental4Windows server. The same logic applies to your Microsoft 365 tenant: mailboxes, SharePoint and OneDrive need their own immutable backups, because Microsoft's retention defaults are not a recovery plan.
How do you catch ransomware data theft before encryption?
You catch it during the dwell time, the window between an attacker getting in and the encryption starting, and that window is where attacks are won or lost. Here's the encouraging part: the steal-first approach takes time. If you can spot the credential theft, the unusual lateral movement, or the large outbound data transfer while it's happening, you can contain the intruder before they detonate anything or finish stealing your files. For the full timeline, see what happens during a ransomware attack.
That's the job of endpoint detection and response (EDR) feeding a human team that's actually watching. Rather than matching files against a list of known viruses, EDR watches what programs actually do, so it can flag brand-new ransomware strains and attackers abusing legitimate admin tools ("living off the land"). Behind it, Key IT's 24/7 SOC service (Security Operations Centre) investigates the alerts around the clock — because attackers deliberately strike overnight and on long weekends, when an unmonitored network has nobody home.
Make it hard to get in, and contain it fast when they do
Detection works best when there's less to detect. Hardening the basics shrinks the number of open doors and slows anyone who gets through one:
Patch and harden relentlessly
Internet-facing systems and unpatched software are common entry points. Mapping your controls to the ACSC Essential Eight — patching, application control, restricted admin rights — closes the doors crews rely on.
Lock down identity
Multi-factor authentication and conditional access stop most stolen-password attacks cold and make lateral movement far harder.
Have a plan you've actually rehearsed
A tested incident response plan means that when an alert fires, containment starts in minutes — isolate the host, cut the attacker's access, restore from clean immutable backups — rather than starting a frantic search for who to call.
And critically: test your restores. A backup you've never recovered from is a hope, not a capability. Tested disaster recovery tells you exactly how long you'd be down in a worst case, before the worst case arrives.
Frequently asked questions
What is double extortion ransomware?
It's an attack where criminals steal a copy of your data before encrypting your systems. That gives them two demands: pay to unlock your files, and pay again to stop them publishing or selling the stolen data. Because the data theft happens first, good backups let you recover your files but don't undo the leak.
If we have backups, do we still need to worry about ransomware?
Yes. Attackers actively hunt for and delete backups before encrypting, so a backup reachable with normal admin access may already be gone when you need it. And because they exfiltrate data first, restoring files doesn't stop a leak. You need immutable, offsite backups plus detection that catches the attack early.
What makes a backup "immutable"?
An immutable backup is written so it cannot be changed or deleted for a set retention period — even by someone holding your administrator credentials. Combined with an offsite or isolated copy, it means an attacker who's deep inside your network still can't destroy your ability to recover.
How does a SOC help against data theft?
A 24/7 SOC watches for the warning signs that come before encryption: stolen credentials being used, unusual lateral movement, and large outbound data transfers. Spotting these during the dwell-time window lets the team contain the attacker before they finish stealing your data or lock your systems.
Should we pay the ransom if attackers have stolen our data?
Paying guarantees nothing. You are relying on criminals to delete what they copied, and stolen data can still be leaked or resold later. In Australia, businesses with annual turnover above $3 million that make a ransom payment must report it to the government within 72 hours under the Cyber Security Act 2024. Get incident response advice before deciding anything.
Is ransomware data theft a notifiable data breach in Australia?
Often, yes. If the stolen data includes personal information and the breach is likely to cause serious harm, organisations covered by the Privacy Act (including health service providers of any size) must notify the OAIC and the affected people under the Notifiable Data Breaches scheme. Restoring from backup doesn't change that, because the data has already left your network.
How can a Melbourne business check its ransomware protection?
Start with three questions: are your backups immutable and offsite, when did you last test a full restore, and would anyone notice credential theft or a large outbound transfer at 2am? Key IT's free IT & Cyber Security Review works through exactly these gaps with Melbourne businesses, so you know where you stand before an attacker finds out for you.
How exposed is your business? A free cybersecurity health check gives you an Essential Eight snapshot and your top three risks.
Request the Free Check