Your Backups Decide What Ransomware Costs You
Ransomware is now a recovery problem more than a ransom problem. Sophos puts the average recovery cost at $1.7 million per incident this year, up 11 percent. The median ransom is lower, at $769,000.
That survey covers organizations with 100 to 5,000 employees, so your own bill would likely be smaller. However, the pattern holds at any size. Recovery costs arrive whether you pay the attacker or not.
Backups change the bill
Sophos research from 2024 found that organizations with intact backups paid a median recovery cost of $375,000. Organizations whose backups attackers had compromised paid a median of $3 million, eight times more.
Backups also work in practice. Sophos found that backup-based recovery handled 66 percent of cases where attackers encrypted data, up 12 points in a year.
Why backups fail
Most backups fail for simple reasons. First, nobody tests them. Many businesses only discover a corrupted or incomplete backup during a real emergency. Second, the backup sits on the same network as everything else. Ransomware can reach a drive that stays plugged in, so it encrypts the backup too.
What to do
A solid setup does not need a big budget.
- Follow the 3-2-1 rule: three copies, on two types of storage, with one copy offsite.
- Keep one copy offline or locked against changes, so ransomware cannot alter it.
- Test a full restore every quarter, and time it.
- Cover every login with multi-factor authentication, including old and service accounts.
- Write down who does what in the first hour of an incident.
Logins matter because attackers often get in through stolen credentials, a risk we covered in passkeys and cyber insurance. For the email side of the same problem, see our guide to email authentication. Unsure whether to handle this yourself? Read when to call IT support.
FAQ
How often should I test my backups?
At least once a quarter. Time the restore, because the speed of recovery matters as much as whether it works.
Is cloud backup enough?
Not on its own. A cloud copy that stays connected to your network can still be encrypted, so keep one copy offline or locked against changes.
Related: why WordPress plugins are your real security risk.
Related: Windows 10 ESU Year 1 ended, so here is what your business should do.
Related: how to patch first, and why backups matter when an update goes wrong.
Getting started
Zavix Media sets up and tests backups as part of our IT support. Book a Free Call, and we will check whether your backups would actually work today.