We keep hearing of big enterprises (Garmin, Edeka) being taken out of business for days or weeks, due to ransomware encryption attacks.

One would assume that it can't be that hard to create versioned backups that can't be overwritten from the system that created them. (After all, most consumer-grade NAS can do it.) So, what am I missing, how is ransomware more than a nuisance?

  • Related: security.stackexchange.com/questions/222082/…
    – mti2935
    Jan 25, 2022 at 17:04
  • 1
    You are assuming that it's just end user files that are getting encrypted. It's more than a nuisance when what gets encrypted are entire VMs that represent the core services of the company like DNS and AD (or the backup server).
    – schroeder
    Jan 25, 2022 at 17:23
  • 2
    The question you should be asking is how large companies get disabled by ransomware.
    – schroeder
    Jan 25, 2022 at 17:25
  • 1
    The simple answer is cost. Every security or resilience control is a cost. You make a judgement on what controls are necessary for your risk appetite and budget. And backups may not be the top priority for many organisations. I think they should be one of the key resilience controls, but in any case, they are not 100% successful (see @schroeder's answer)
    – Rory Alsop
    Jan 25, 2022 at 17:58

2 Answers 2


You reference Garmin, so let's look at that:

"cyber criminals targeted Garmin with a ransomware attack that encrypted the company’s internal systems and shut down critical services"

"online services were interrupted including website functions, customer support, customer-facing applications, and company communications."


For large companies, we are not simply talking about end user files being encrypted, like Word and Excel files, but backup files and VM files. These are not typically backed up since they tend to be huge and a modern large company will have thousands of them, which makes it too difficult to copy and store on tape somewhere.

If all VMs are encrypted, and AD, backup systems, DNS, etc. are on those VMs, you have no means of logging in to anything to start a restore.

In addition, before files get encrypted, attackers tend to want to control the backup system in order to delete or corrupt the backup files in order to prevent their use in recovery.

In addition, in large companies, if there are off-site tape backups, they can take time to recover and the data might be old enough that there will be financial harm if they are used instead of trying to recover more recent data. Even a couple of day's worth of data can represent millions of lost revenue.

So, the question is not "how can we get a better backup?" but rather, "how can we limit how far an attacker can worm into our company and limit the blast radius?" Backups help, but they are not a total solution.

  • Why didn't they use immutable backups? Why didn't they segment their networks and separate backup system from AD?
    – user996142
    Jan 26, 2022 at 11:47
  • 1
    @user996142 because not everyone thinks about redesigning their entire infrastructure that's been in place for a decade to account for an emerging threat? We could spend all day on "they could have done X, Y, and Z!"
    – schroeder
    Jan 26, 2022 at 14:39

Restoring data from backup is a manual process, it can be very tedious and take a long time. And you are always going to lose something, not every data is saved in real time but more like in daily snapshots. Workstations will most likely have to be reinstalled from scratch.

Imagine a large organization with hundreds or thousands of workstations. Even with extensive automation, PXE boot provisioning etc - you are not going to fix the problem in 5 minutes. And that assumes you have competent personnel at hand which is not a granted. Reminds me of Aramco. Look it up.

The bigger problem lies elsewhere: data leaks. By the time the ransomware is actioned, lots of sensitive data may have been exfiltrated by the attackers. Which after all is the essence of ransomware: pay up or we release all your data on the public Internet (or darknet).

Sure, you can restore the data on your end (maybe) but once it's out you can't take it back.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .