A backup is supposed to be the last safe copy of your business data. But if an attacker has been inside your systems for days or weeks before encrypting files, that safety net may already contain malicious code, corrupted data, or encrypted copies. So, can ransomware spread through backups? Yes – particularly when backups are continuously synced, poorly isolated, or managed with the same credentials as production systems.

For a small business, this can turn a ransomware event from a difficult interruption into a prolonged recovery problem. The good news is that backup exposure is manageable when recovery is treated as a security function, not simply a storage function.

How ransomware reaches backup systems

Ransomware does not need to “move” through a backup in the same way it spreads across a network. More often, it compromises the systems, accounts, and processes that create or manage backups. Once it has access, it can encrypt backup files, delete restore points, alter retention settings, or wait for infected files to be copied into the backup environment.

The risk is highest where backup platforms are tightly connected to live business systems. A file that becomes encrypted on a workstation or server may be replicated to a cloud drive or backup repository within minutes. If old versions are not retained, the healthy file can be replaced by the encrypted version before anyone notices the incident.

Attackers also target backup administration consoles. If a backup administrator uses the same password for daily IT tasks and backup management, a stolen credential can give an attacker direct access to the organisation’s recovery option. From there, they may delete backups or shorten retention periods before launching encryption across the network.

The danger of delayed ransomware activation

Many ransomware groups now spend time inside an environment before making their presence obvious. During that period, they may identify backup software, map storage locations, steal credentials, and disable security controls. They may also introduce malware into files or applications that are then copied into routine backups.

This creates a difficult recovery question: which restore point is genuinely clean? The newest backup may contain encrypted files or a hidden threat. The oldest available backup may be too outdated to support normal operations without significant data loss. A well-designed backup strategy gives the business enough recovery history to make an informed choice.

Can ransomware spread through backups in the cloud?

Cloud backup is not automatically protected from ransomware. It can provide strong resilience, but only when the service is configured with versioning, retention controls, access restrictions, and separate administration. A cloud folder that simply synchronises changes from an infected device can quickly replicate encrypted files to every connected location.

This does not mean businesses should avoid cloud storage. It means they should understand the difference between synchronisation and backup. Synchronisation keeps files current across devices. Backup preserves recoverable versions over time. Both are useful, but a synced folder alone is not a reliable ransomware recovery plan.

Cloud platforms can also be exposed when access is granted too broadly. Shared accounts, unrestricted administrator permissions, and multi-factor authentication that is not enforced create avoidable risk. An attacker who takes over a highly privileged account may be able to remove recovery points and lock out legitimate users.

What makes a backup resistant to ransomware?

A ransomware-resilient backup is designed so that compromising the main network does not automatically compromise the recovery copies. The most effective approach combines separation, immutability, and routine validation.

Separation means backup infrastructure is not treated as just another shared drive. It should have restricted access, dedicated administration accounts, and network controls that limit who can reach it. Backup systems should not rely on the same privileged credentials used for everyday server or workstation management.

Immutability means backup data cannot be changed or deleted for a defined retention period, even by an account with elevated access. This is one of the strongest protections against ransomware, but its value depends on correct configuration. Retention settings must match the likely time an attacker could remain undetected.

Version history provides several points in time from which to restore. Daily backups alone may not be enough if a threat has been present for weeks. Businesses should agree on retention periods based on their data, regulatory obligations, and acceptable recovery window.

Offline or logically isolated copies add another layer of protection. An offline copy is disconnected when not in use. A logically isolated copy may remain online but is protected by separate credentials, tenancy, access policies, and security controls. The right balance depends on how quickly the organisation needs to restore and how much operational complexity it can support.

Tested recovery is the control that proves all the others work. A backup that exists but cannot be restored quickly, safely, and completely will not protect the business when pressure is high.

How to restore safely after a ransomware incident

Restoring immediately from the latest backup can be risky. The priority is to stop the attack, preserve evidence where appropriate, and identify a recovery point that is unlikely to contain the threat.

First, isolate affected devices and systems from the network. Do not reconnect them simply because files have been restored elsewhere. The original entry point, compromised account, or unpatched vulnerability must be addressed before normal operations resume.

Next, review available restore points. Look for the earliest signs of unusual file changes, unauthorised account activity, disabled security tools, or abnormal backup deletion attempts. Your recovery point should predate those indicators where possible.

Restore into a controlled environment before returning systems to production. This allows IT teams to scan for malware, check application behaviour, validate file integrity, and confirm that key services work as expected. It may take longer than a direct restore, but it reduces the chance of reintroducing the attacker into a cleaned network.

Business priorities matter here. A company may need its accounting system, customer records, email, and core operational applications restored in a particular order. Documenting that order before an incident helps reduce downtime and avoids decisions being made under pressure.

Common backup weaknesses to address now

Many organisations have backups, yet remain vulnerable because the backups have not been built for an active attacker. Warning signs include a single backup location, always-connected storage, one administrator account for everything, no multi-factor authentication, and restore tests that have never been performed.

Another common issue is assuming endpoint backups are enough. Servers, cloud applications, virtual machines, databases, and employee devices may all hold business-critical information. If a system is not included in the backup scope, it should not be assumed recoverable.

Retention also needs attention. Keeping only a few days of copies may suit accidental deletion, but it may fail against a long-running ransomware intrusion. More retention can increase storage costs, so the objective is not to retain every version forever. It is to maintain clean, usable recovery points for a period that reflects your real risk.

A practical backup resilience checklist

Before the next incident, your IT team or managed service provider should be able to answer these questions clearly:

• Are backup accounts separate from standard administrator accounts and protected by multi-factor authentication?
• Do we have immutable or isolated backup copies that an attacker cannot easily delete or encrypt?
• How long are restore points retained, and does that period account for undetected threats?
• Have we tested a full restore of critical systems, not only individual files?
• Can we identify the order in which systems must be restored to keep the business operating?
• Are cloud applications, databases, endpoints, and servers all covered by a documented backup plan?

For growing businesses, this level of oversight is often difficult to maintain alongside daily support requests and infrastructure changes. A managed IT partner can monitor backup jobs, review failed backups, enforce access controls, and test recovery procedures as part of ongoing operational support. URBlink helps businesses align backup and cybersecurity controls so recovery planning supports real business continuity.

The right question is not whether you have a backup. It is whether you can restore a clean, verified copy after an attacker has tried to remove every path back. Building that confidence now gives your team a clearer route forward when every hour of downtime matters.