Backups Are Not Enough When Attackers Skip Encryption

Attackers increasingly steal data and threaten to leak it without encrypting anything, which means intact backups no longer neutralize the threat. Your applications stay online and your restore points are fine, and the leverage has shifted from “we locked your files” to “we will expose your data,” so resilience now requires limiting what can be stolen alongside the ability to recover.

Key takeaways

• Traditional ransomware attacked availability, which made backup and disaster recovery the natural counter. Data extortion attacks confidentiality instead, so restoring cleanly does not remove the attacker’s leverage.
• The extortion pattern is: gain access, locate high-value data, quietly copy it over days or weeks, leave systems running or cause limited disruption, then demand payment for silence.
• Backups restore systems and reduce downtime. They do not limit what an attacker can see and steal, reduce the sensitivity of what leaves the network, handle regulatory notification and legal risk, or protect reputation once stolen data appears online.
• A modern strategy needs three layers rather than one: prevent and detect intrusions early, limit what can be stolen and how useful it is once taken, and recover and respond in a way that restores both operations and trust.
• Backup and archive systems are themselves a target, because they hold the most complete and longest-lived copies of an organization’s data, including historical records no longer present in production.
• Over-retention increases extortion risk. Keeping everything forever means storing more information for an attacker to misuse, so retention should be matched to real legal and business requirements rather than defaulted to indefinite.

The leverage moved. The plan did not.

For years, ransomware has meant one thing in most boardrooms: encrypted systems and a race to restore from backup. If you could recover quickly, you had a real chance to avoid paying and get back to business.

Attackers have adjusted.

More campaigns now focus on stealing sensitive data and threatening to leak it, sometimes without encrypting anything at all. Your applications stay online. Your backups are intact. Yet you still face the same pressure, because the leverage is no longer “we locked your files,” it is “we will expose your data.”

In that world, having backups is necessary, but not sufficient. Resilience now means planning for extortion, not just recovery.

From encryption to exposure

Traditional ransomware revolved around availability. Attackers wanted to make your systems unavailable until you paid for a decryption key. Backup and disaster recovery were the natural counter. If you could restore clean data quickly, you broke the attacker’s business model.

Data extortion flips the script. The attacker:

• Gains access to your environment
• Finds high value data sets
• Steals copies quietly, sometimes over days or weeks
• Leaves systems running, or performs limited disruption
• Demands payment in exchange for silence

Sometimes encryption still happens. Sometimes it does not. In both cases, the harm comes from exposure:

• Customer data posted on leak sites
• Confidential contracts and internal emails made public
• Intellectual property offered to competitors
• Regulatory scrutiny and legal action

You can restore from backup all day long and still have a serious incident on your hands if you have not prepared for this kind of pressure.

Why “we have backups” is no longer a complete answer

Backups solve a specific problem. They restore systems and data to a known good state. They reduce downtime. They keep you in control when files are locked or destroyed.

They do not, by themselves:

• Limit what an attacker can see and steal
• Reduce the sensitivity of what leaves your network
• Handle regulatory notifications and legal risk
• Protect your reputation when stolen data appears online

That means a modern ransomware strategy has to cover three layers, not one:

1. Prevent and detect intrusions as early as possible.
2. Limit what can be stolen and how useful it is if it leaves.
3. Recover and respond in a way that restores operations and trust.

Backup and disaster recovery sit squarely in the third layer. They are critical, but they need to be tied into the others if you want a complete defense against data extortion.

Treat backups and archives as sensitive targets

Data extortion also affects how you think about your own backup environment.

Attackers know that backup and archive systems hold some of the most complete, long lived copies of your data. If they reach those systems, they can:

• Access historical records that are no longer in production
• Collect larger, richer data sets than they would find in one application
• Destroy or tamper with restore points to add more pressure

So the first shift is cultural. Backup is no longer “just IT plumbing.” It is part of your sensitive surface.

Practical steps include:

• Isolating backup networks from general user traffic
• Using strong identity controls and multifactor authentication on backup consoles
• Logging and reviewing backup configuration changes
• Applying role based access so only a small group can modify retention or delete backups

At CyberFortress, we design backup platforms under the assumption that attackers will go looking for them. That mindset drives everything from network layout, to identity design, to how and where data is written.

Know what you are backing up, and why

In an extortion scenario, over retention can increase your risk. If you keep everything, forever, you are storing more information for attackers to misuse.

Work with data owners to:

• Classify what data lives in which systems
• Map those systems to backup policies
• Match retention periods to real legal and business requirements
• Reduce or tokenize sensitive data when possible

You still need to meet compliance obligations and litigation needs, but you should be intentional about the tradeoffs. CyberFortress teams often help customers tune retention so they protect what they must, without keeping unnecessary copies of high risk data.

Connect backup and DR to incident response

Data extortion incidents are not only technical events. They are business events.

Legal, compliance, communications, and leadership all need timely information. They need to know:

• What categories of data were likely exposed
• Which customers, partners, or employees might be affected
• Which systems are safe to restore and which require further review

Backup and DR teams are central to those answers. They know where data lives and what restore points are available. Yet in many organizations, recovery plans and incident response plans sit in separate binders.

Bringing them together makes a big difference:

• Include backup and DR stakeholders in incident response planning
• Define how backup catalogs and recovery points will be used to support forensics and scoping
• Document which environments can be used for clean, isolated restores during an investigation

CyberFortress aligns recovery runbooks with customer incident response processes. That way, when an event happens, operational recovery and business communication move together rather than in parallel.

Controls that reduce extortion leverage

If backups are your safety net, other controls help reduce how far you fall.

Key practices that complement backup include:

• Segmentation and least privilege so that a single compromised account cannot see every data store in the organization.
• Encryption of sensitive data at rest and in transit with proper key management, so stolen files are not immediately readable.
• Monitoring for unusual data access and large transfers, especially from service accounts and administrative users.
• Regular reviews of shadow IT and unsanctioned SaaS data stores, which often hold sensitive information outside of formal protection.
• Tabletop exercises that simulate extortion scenarios, including ransom demands tied to leaks, public disclosure, and media interest.

These measures do not replace backup. They increase the likelihood that, if data is stolen, the amount and usefulness of that data is limited.

How CyberFortress guides customers through this shift

CyberFortress was built on a simple promise: when something goes wrong, you are not on your own.

In a world of data extortion, that promise covers more than restoring a few servers. It includes:

• Designing backup and DR architectures that assume attackers might bypass encryption and go straight to data theft.
• Implementing immutable, isolated backup copies so you have reliable recovery options even if production environments are compromised.
• Helping teams align retention, classification, and backup policies with both resilience and privacy in mind.
• Working alongside your security and incident response teams during an event through the Trinity Platform, so you can move from uncertainty to a clear, guided plan.

Backups remain the foundation of recovery. They keep your business running when systems fail or attackers encrypt your data. When attackers skip encryption and move straight to extortion, that foundation still matters, but it has to be part of a broader structure.

Education, preparation, and the right partners turn “we have backups” into “we have a plan.”

CyberFortress is here to help you build that plan before you need it.

Frequently asked questions

What is data extortion, and how is it different from ransomware? Traditional ransomware encrypts systems and demands payment for a decryption key, attacking availability. Data extortion steals sensitive data and threatens to publish it, attacking confidentiality. Systems may stay fully online throughout, which means the victim faces the same pressure with none of the usual signals that an attack has occurred.

If our backups are intact, why are we still at risk from ransomware groups? Because backups solve availability, not exposure. They restore systems to a known good state and reduce downtime, and they do nothing to limit what an attacker saw and copied, reduce the sensitivity of what left the network, satisfy regulatory notification obligations, or protect reputation once stolen data is posted publicly.

Why do attackers target backup and archive systems specifically? Backup and archive environments hold the most complete and longest-lived copies of an organization’s data. Reaching them gives an attacker access to historical records no longer in production, richer data sets than any single application would yield, and the ability to destroy or tamper with restore points to increase pressure.

How should backup infrastructure be protected against data theft? Treat it as a sensitive surface rather than IT plumbing. Isolate backup networks from general user traffic, apply strong identity controls and multifactor authentication on backup consoles, log and review configuration changes, and use role-based access so only a small group can modify retention or delete backups.

Can keeping too many backups actually increase risk? Yes. In an extortion scenario, over-retention means storing more sensitive information for an attacker to misuse. Retention should be matched to genuine legal and business requirements, with data classified by system, mapped to backup policies, and reduced or tokenized where possible while still meeting compliance and litigation obligations.

What controls reduce an attacker’s extortion leverage? Segmentation and least privilege so one compromised account cannot reach every data store, encryption at rest and in transit with proper key management so stolen files are not immediately readable, monitoring for unusual data access and large transfers particularly from service and admin accounts, reviews of shadow IT and unsanctioned data stores, and tabletop exercises that rehearse leak-based extortion including public disclosure and media interest.

CyberFortress provides backup architecture designed on the assumption attackers will come looking for it. Contact us to build the plan before the leak site does it for you.