Ransomware Recovery Hinges on Backup Retention and Restore Access
Most IT teams feel ready for a ransomware attack, but a survey from Veeam shows a stark gap between confidence and recovery. In a study of more than 900 senior IT, security, and risk leaders, 90% said they were confident they could recover from a cyber incident. Yet among organisations actually hit by ransomware that affected operations or data, only 28% fully recovered, and 44% recovered less than three-quarters of what they lost. Ransomware is malicious software that locks or encrypts files and demands payment to unlock them. The real weakness, according to a recent analysis from backup provider Backblaze, is not the incident response plan on paper, but whether the computer backup itself was built to survive an attack.
Ransomware groups know that backups are the victim's way out, so they target backup repositories directly. Backup repositories are the storage locations where backup copies live. Veeam's data protection research found that 96% of ransomware attacks specifically go after these repositories, and most of those attempts succeed. If an attacker can delete backup history or shorten how long files are kept, the backup stops being a recovery plan and becomes a second target. That is why deleted file retention and restore permissions matter more than almost anything else. Deleted file retention is how long a backup service keeps files after they are removed from the device. Backblaze's Computer Backup product keeps a full year of version history and deleted file retention, and restore and deletion permissions sit with IT centrally, not open at the device level for anyone to touch. Some legacy endpoint backup tools also offer long retention, but the real test is how well they restore under pressure.
Version history is where the real work happens. Ransomware does not always announce itself right away. Some strains sit quietly on a network for weeks, copying and encrypting slowly, before anyone notices. By the time an infection is caught, the most recent backup might already contain encrypted files. If a backup only keeps a few days of history, and the malware has been running for two weeks, there is no clean version to restore, only a slightly newer copy of the same problem. This is a common gap with cloud sync tools that many businesses rely on instead of true backup. Sync tools copy files between devices but usually keep limited version history that varies by plan, which may be fine for undoing an accidental edit but not for ransomware recovery. One IT director gave a direct comparison: a full year of version history against a previous vendor's three-day maximum. The extra retention is what actually lets an organisation go back far enough to find a version worth restoring. Short retention windows are sometimes sold as a way to keep storage costs down, but in practice they are one of the more common reasons recovery fails.
A ransomware incident often triggers more than a technical response: insurance claims, regulatory questions, sometimes litigation. All of that requires preserving data exactly as it was, separate from normal backup retention rules. That is what legal hold is for. Legal hold is a setting that preserves a device's backed up data beyond the standard retention window. It is a different function from version history. Version history lets an organisation go back in time; legal hold freezes a specific point and keeps it there. Backblaze offers legal hold with Computer Backup with Enterprise Controls. The common mistake is that IT and legal never discuss legal hold until the middle of an actual incident, when they are improvising a process that should have been decided in advance. Decisions about when a hold would be triggered, and who in IT and legal makes that call, need to be made before an attack.
Company-wide backup policy is one thing; restoring 40, 100, or 300 individual laptops without the entire IT team dropping everything else is a different problem. Many recovery plans fall apart because they are written at the policy level and never tested at the device level. Before an incident, teams should answer some practical questions: Can you restore a single file without pulling down an entire device image? Can you restore an entire device to a new machine if the original is unusable? Who has permission to approve and run a restore, and is that list accurate right now? For a mass-restore situation across dozens of devices, does the vendor offer any option beyond restoring one machine at a time, such as a physical drive shipped with the data preloaded? These are not edge cases; they are the actual mechanics of recovery. A single file restore depends on whether version history goes back far enough to find a clean copy. A single device restore depends on data size, bandwidth, and whether restore access is sorted out. A full fleet restore of dozens to hundreds of devices is where things slow down. Restoring machine by machine can take days, and some vendors, including Backblaze, can ship a physical drive preloaded with data to cut that down significantly. Only 9% of IT teams describe restoring from backup as "very easy," according to Backblaze's State of the Backup Report. Most people find out how hard restoring actually is right when they need it to work.
A real recovery plan needs a pressure test. The analysis recommends walking through a restore on paper, from start to finish, for one real laptop. Name the device, the person who approves the restore, the person who runs it, and where the data goes. Write down each step and where it could stall. A vendor's feature list can tell you whether version history, deleted file retention, legal hold, and endpoint-level restore are technically available. It cannot tell you whether your team knows how to use them under pressure. Walking through the steps, and testing with the vendor's team in a proof of concept, is how gaps are found. Backblaze Computer Backup with Enterprise Control is built around these specific gaps: a full year of version history and deleted file retention, legal hold to preserve data beyond standard retention, and restores managed by IT from the admin console. It is native to Mac and Windows and deploys through Jamf, Iru (formerly Kandji), and Addigy. Pricing is flat per device with no per-GB surprises. None of this replaces good security practices, but it goes a long way toward deciding whether ransomware turns into a bad week or a bad year. For organisations looking to apply these lessons on any infrastructure, AEU Data's managed cloud and data infrastructure offers automated backups, encrypted storage, and monitoring that help keep recovery copies durable and under central control.