Ransomware locks your files and asks for money to unlock them. A good backup turns that from a crisis into a bad day: you wipe the machine, restore your files and carry on. The same backup also saves you from a dead disk, a stolen laptop, a spilled coffee and the folder you deleted by mistake.
How ransomware gets in
The usual ways in are a phishing e-mail with a link or attachment, a stolen password for a remote access service, and software that faces the internet and was never updated. Many groups now copy your data before they lock it, then threaten to publish it. Backups solve the locked files. They do not solve the leak, so prevention still matters: updates, strong sign-in, and care with links.
The 3-2-1 rule
The rule is old and still right. Keep three copies of anything that matters: the original and two backups. Keep them on two different kinds of storage, for example your computer's disk and an external drive, or an external drive and a cloud backup service. Keep one copy away from the others, so a fire, a burglary or a piece of malware cannot reach all three at once.
Why one copy must be out of reach
Ransomware locks everything it can reach. That includes a backup drive that stays plugged in, a shared network folder and anything the infected computer can write to. So at least one copy needs to be unreachable from your everyday devices:
- Offline: an external drive you connect for the backup and unplug afterwards. Rotate two drives and keep one somewhere else.
- Immutable: many cloud backup and storage services can lock each backup so it cannot be changed or deleted for a set number of days, even by you. Turn this on if your service offers it.
- Separate sign-in: protect the backup account with its own strong password and a passkey or two-factor sign-in. If an attacker gets your e-mail, they should not get your backups too.
A sync folder is not a backup on its own. Services that keep a folder the same on all your devices also copy a locked file or a deletion to every device. Most keep a version history, which helps. Check how far back it goes and how to restore a whole folder from it.
What to back up, and how often
Back up what you could not replace: documents, photos, accounts and invoices, client work, e-mail you need to keep, and for a website, both the files and the database. Store the recovery codes for your important accounts somewhere safe too, on paper if you like.
How often depends on how much work you can afford to lose. For a business, daily is a sensible minimum. Keep several versions going back weeks, because ransomware can sit unnoticed for days, and last night's backup may already contain locked files.
Test your restores
A backup you have never restored is a hope. Every few months, restore one folder to a different place and open some files. Once a year, try a full restore of a computer or a website to a spare machine or a test address. Time it and write down the steps. When something goes wrong, you will follow your own notes instead of guessing.
If ransomware hits
Disconnect first: unplug the network cable and turn off Wi-Fi on every device that shows the ransom note. If you cannot disconnect a device, shut it down. Never plug a backup drive into a machine that might still be infected.
Next, get help and report it. Tell the police. Businesses in the EU that lose control of personal data may have to notify their data protection authority within 72 hours under the GDPR. The No More Ransom project, run by Europol, national police forces and security companies, offers free decryption tools for some ransomware families. It is worth a check before you rebuild.
Agencies including CISA and the UK NCSC advise against paying. Paying does not guarantee you get your files back or that the stolen copy is deleted, and it funds the next attack. CISA's StopRansomware pages and the NCSC guide to backing up your data go into more depth.
Common questions
- Is an external drive enough?
- It is a good start. Unplug it after each backup and add a second copy somewhere else, such as a cloud backup service or a second drive kept away from home.
- Should my backups be encrypted?
- Yes, especially a drive that leaves the house or a copy in the cloud. Keep the key or password somewhere you can reach if your computer is gone.
- How long should I keep old versions?
- At least a few weeks. A longer history gives you a clean copy to go back to if an infection went unnoticed.
- Is my phone backed up?
- Only if you turned it on. Check the backup settings on your phone and the date of the last backup.
Pick one folder today and restore it from your backup. If that works, you have a backup.