Cybercriminals Want Your Backups – Here’s How to Keep Them Safe

Cyber crime gets more advanced, and threat actors increasingly target backups with ransomware attacks. If an organization is left with erased or corrupted data and has no access to backup copies, there is no chance of recovery. This allows the attackers to demand ransom payments averaging at over 10 million dollars as of 2025.

That is why your backup and disaster recovery strategy should be reliable and secure to keep your environments protected and guarantee business continuity.

The golden 3-2-1 backup rule 

Never forget the basics. The 3-2-1 backup rule is what true data resilience is built on. The rule requires at least: 3 copies of data, on 2 different media, with one being off-site. There are other rules worth mentioning, such as:

💡 3-2-1-1-0 rule: 3 copies, 2 media types, 1 off-site, 1 immutable/air-gapped, 0 errors after testing
💡 4-3-2 rule: 4 copies, 3 storage tiers, 2 isolated environments

With these applied, organizations can build resilient backup and recovery strategies. This allows for redundancy, isolation, and immutability to keep data safe. Now, a third-party backup solution can automatically enforce these rules for your and maintain continuous protection, along with other advanced automation capabilities that we’ll explore in later sections.

Common challenges with backup security 

Attackers target backups to remove the option for recovery. Ensuring that an organization covers all risks, demands a thorough analysis of the security practices and backup requirements. When choosing a solution it is important to also consider flexible restore options. Appropriate implementation of a backup and DR strategy comes with challenges that need addressing.

Human error remains on top 

Even with advanced cyber security measures, human error is still the most common cause of data loss. Accidental deletions, misconfigured policies, over-permissive access roles, and inconsistent monitoring can compromise backup integrity long before a cyberattack even occurs.

Specific examples of human error include:

• In fast-paced environments, backup settings can drift away from the desired standard, making backups inconsistent.
• Using GitHub/GitLab/Bitbucket/Azure DevOps/Jira as a backup and recovery solution.
• Overwriting data and lost versions.
• Accidental deletion of important data.

Shared Responsibility Model 

Platforms like GitHub, Azure DevOps, GitLab or Bitbucket all operate under the shared responsibility model. It is a division of duties between the service provider and the user. In the SaaS model, the provider takes care of their infrastructure and uptime while the user is responsible for data security. For the users this includes securing devices, accounts as well as access controls but also backup and recovery.

Compliance with DevOps industry regulations 

Backup along with disaster recovery are both requirements demanded by industry regulations such as SOC 2 Type II or ISO 27001. Choosing an appropriate backup solution will help you pass audits, avoid penalties and keep your data protected against cyber criminals. Main compliance standards applying to DevOps data include:

• SOC 2 Type II 
• ISO 27001 
• NIS 2 
• DORA 
• FINRA 
• GDPR 
• HIPAA (healthcare)

Make sure your backup and recovery solution is compliant with the relevant compliance frameworks to guarantee industry-standard protection. Common aspects that need addressing, in terms of backup, include: access control, backup frequency, geo-redundancy, encryption, and retention. However, these will range from industry to industry, based on data criticality. For example, government entities focus heavily on immutability, auditability, and long-term retention, while healthcare environments prioritize encryption and strict access controls to protect patient health information.

Scaling organizations with increasing data volume 

There may be a time where you ‘outgrow’ your backup solution, and will need to change providers, migrate data and implement new security measures. When choosing a backup vendor, make sure that the solution can grow along with your organization and continuously cover your data protection requirements.

More data with increased operational complexity requires notifications, alerts and status updates regarding all tasks. Comprehensive platforms like GitProtect.io provide a centralized management console, to simplify the user experience and facilitate transparency. From there organizations can view things like logs, tasks in-progress, and reports.

How cyber criminals breach access 

Cyber criminals come up with more sophisticated ways to breach your data. The attackers’ goal is to make data recovery impossible so the victim will pay ransom. Therefore, reliable backup is necessary, as attackers increasingly target the backup data, which is the key to any recovery process.

The common attacks include:

• Stolen admin credentials – these privileged credentials are obtained through phishing, token theft, or reusing credentials.
• Misconfigured IAM and access controls can give attackers access to the backup storage.
• Supply-chain attacks on integrated services – this includes compromising CI/CD systems, automation tools, secrets managers, or other connected services.
• Breaching and compromising the user’s DevOps platform first – if cybercriminals gain control of a GitHub, GitLab, Azure DevOps, or Bitbucket account, they can directly delete or corrupt repositories and metadata (native retention is not true backup).

💡 In the 2024-2025 Change Healthcare ransomware attack, the organization paid a $22 million ransom but still did not get its data back. The incident shows that even ransom payment does not guarantee recovery – only reliable, isolated backups and a tested recovery process. 
💡 CDK Global was hit with a ransomware attack that shut down systems across the industry. The outage cost dealerships over $1 billion collectively and demonstrated how a single compromised vendor can cripple thousands of businesses at once.

Best practices to ensure secure backup processes

Secure backup grants reliable recovery. Therefore, the solution you opt for must meet all of your specific criteria in terms of coverage, retention, frequency, scheduling and automation. While cyber attacks are on the rise, it is still in your hands to keep data protected.

Shift security to the left 

Backups should be integrated into the SDLC from the very beginning. With this approach, many risks can be eliminated before they reach production. Shift security left to support business continuity and data resilience from the start.

Set RTO and RPO 

These two metrics (RTO & RPO) determine how often backups are made and how quickly the restore must happen to keep the business running.

💡 Recovery Time Objective (RTO): how long your organization can afford to be down 
💡 Recovery Point Objective (RPO): how much data you can afford to lose

Make sure to calculate the acceptable outage duration before operations, revenue, or customers are affected. Then, consider the maximum time gap between your backups. Is losing 24 hours of work acceptable, or do you need snapshots every few minutes?

Automate backups for better security & time management 

Third-party backup and recovery solutions provide automation that supports organizations on many levels. First off, there is less time spent on manual handling of any backup process. Moreover, automation skips the human element and decreases the chance of human error. With secure, automated backups, teams can stick to their primary objective and support business continuity.

WORM-compliant, immutable storage 

Reliable backup vendors keep data in WORM-compliant, immutable storages. Write once, read many (WORM) storage guarantees that data cannot be altered or erased. This ensures that even if attackers get a hold of your data, they will not be able to do anything with it.

Crucial backup functionalities

A complete backup and disaster recovery (DR) solution provides flexible functionalities that secure your day to day operations. Ideally, your vendor shall include clear policies, and scheduling capabilities to accommodate your RPO requirements and provide you with a central management console for simplicity of use.

• Make sure to have full coverage and unlimited retention.
• Leverage GFS (Grandfather-Father-Son) – structured restore points: daily (sons), weekly (fathers), and monthly (grandfathers). This balances long-term retention with storage efficiency.
• Combine full, differential and incremental backups for efficient data protection and rapid recovery without needless overhead.
• Air-gap keeps your backup copy completely separated from production, so attackers cannot reach backups even if the main environment is compromised.
• Geo-redundancy means storing backup copies across independent geographic locations to protect against regional outages, cloud provider failures, and localized disasters. Multi-region redundancy grants that even if one site is unavailable, your recovery paths remain intact.
• Encryption guarantees that backup data is unreadable to individuals without the key.

[FREE TRIAL] Keep your DevOps environment protected with a 14-day trial — guarantee compliant backup and disaster recovery, even in the event of accidental partial loss 🚀

[CUSTOM DEMO] Find out how GitProtect’s backup & DR solution for DevOps helps to mitigate risks and recover your data in no time.