How to back up your business so ransomware can't end it

Ransomware locks up your files and demands payment to unlock them. Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of all breaches, and of the ransomware victims whose size was known, about 96% were small and mid-sized businesses (fewer than 1,000 employees) (Verizon 2026 DBIR). The same report found that 69% of ransomware victims didn't pay. Backups that survive an attack are what make that choice possible.

The FBI received more than 3,600 ransomware complaints in 2025, up from 3,156 in 2024, and notes that reported losses don't include lost business, time, wages, or files, so the real cost is much higher (FBI Internet Crime Report 2025).

You can't make an attack impossible. But with the right backups, you can recover without paying. Here's how.

Why ordinary backups often fail

Many ransomware attacks look for backups first and delete or encrypt them too. If your backup is a drive that's always plugged in, or a shared folder on the same network, it can be locked along with everything else. CISA's ransomware guidance specifically recommends keeping offline, encrypted backups of critical data, and testing them regularly (CISA #StopRansomware Guide).

Step 1: List what you can't lose

Write down the data your business can't run without: accounting files, customer records, contracts, email, and anything stored in cloud apps. For each, note where it lives and who's responsible for it.

Step 2: Follow the 3-2-1 rule

A widely used rule of thumb for backups:

• 3 copies of your important data (the original plus two backups)
• 2 different types of storage (for example, a local backup device and a cloud backup service)
• 1 copy kept offline or off-site, where ransomware can't reach it

Step 3: Make one copy untouchable

Keep at least one backup disconnected from your network, or use a backup service with "immutable" or versioned backups that can't be deleted or changed for a set period, even by an administrator account. Encrypt your backups so a stolen drive doesn't become a data breach.

Step 4: Lock down the backup account

Use a separate, strong password and multi-factor authentication for your backup system, different from your everyday logins. If an attacker steals one employee's password, they shouldn't be able to delete your backups with it.

Step 5: Test a restore, not just the backup

A backup you've never restored is a hope, not a plan. At least every quarter, pick a few important files (or a whole computer) and actually restore them. Time how long it takes. That number is how long your business would be down.

If ransomware hits

Disconnect affected computers from the network (unplug the cable or turn off Wi-Fi) but don't turn them off, then call for help immediately. Report the attack to the FBI at ic3.gov. If you have cyber insurance, call your carrier early; many policies require prompt notice.

Sources: Verizon 2026 Data Breach Investigations Report · FBI Internet Crime Report 2025 · CISA #StopRansomware Guide · FTC: Ransomware risk and your small business