Immutable Backups: Your Best Defence Against Ransomware

Immutable backups are backup copies that cannot be changed or deleted for a set period, not even by an administrator. Ransomware gangs know that good backups mean you won't pay, so they try to destroy backups first. An immutable copy survives that attack, which makes it the difference between restoring your business and negotiating with criminals.

Why attackers go after your backups

Ransomware is malware that encrypts (scrambles) your files and demands payment for the key. It is common: Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of breaches. The 2025 edition found it in 88% of breaches at small and mid-sized organisations.

Modern attackers don't just encrypt your files and leave. They often spend days inside your network first, finding admin passwords and your backup server. Then they delete or encrypt the backups before triggering the ransomware.

Veeam's 2023 Ransomware Trends Report, based on a survey of 1,200 organisations hit by at least one attack in 2022, found:

• Attackers tried to hit backup repositories in 93% of cyber events.
• 75% of organisations lost at least some of their backups.
• 39% lost their backup repositories completely.
• 21% paid the ransom and still didn't get their data back.

The US Cybersecurity and Infrastructure Security Agency (CISA) says the same in its #StopRansomware Guide: many ransomware variants search for and delete or encrypt accessible backups. CISA's advice is to keep offline, encrypted backups of critical data and to test them regularly.

What makes a backup immutable

"Immutable" means unchangeable. An immutable backup is written once and then locked for a retention period you choose, say 30 days. During that time nobody can edit, encrypt or delete it.

This is often called WORM storage, short for write once, read many. Common ways to get it:

• Cloud object lock. Services like Amazon S3, Azure Blob Storage and others let you lock stored files. In Amazon S3's compliance mode, a locked file can't be overwritten or deleted by any user, including the account's root user, until the lock expires.
• Hardened backup appliances. Some backup products offer a locked-down Linux repository or appliance that refuses deletes during the retention period.
• Offline media. Tape or a removable disk that is physically unplugged and stored away. It's not "immutable" in the software sense, but attackers can't reach it.

Immutable vs air-gapped vs just "backed up"

Type	Can an attacker with admin access delete it?	Notes
Normal backup on a network drive	Yes	Often the first thing ransomware destroys
Cloud sync (OneDrive, Google Drive)	Often yes	Sync copies changes, including encrypted files. Version history helps but isn't a full backup
Immutable backup (object lock, compliance mode)	No, until the lock expires	Protected even from stolen admin passwords
Offline / air-gapped copy	No, while disconnected	Needs discipline to rotate and store

One watch-out: some cloud locks have a "governance" mode that lets privileged users remove the lock. That's useful for testing, but an attacker with those privileges can remove it too. For ransomware protection, use the strict mode.

The 3-2-1-1-0 rule

The classic 3-2-1 backup rule is a good starting point. The modern version adds two more numbers:

• 3 copies of your data (the original plus two backups)
• 2 different types of storage (for example, a local backup box and the cloud)
• 1 copy offsite
• 1 copy immutable or offline
• 0 errors when you test a restore

That last "0" matters most. A backup you've never restored is a hope, not a plan.

How to set up immutable backups (SME version)

Here's a practical path for a clinic, accounting firm or small manufacturer:

1. List what matters. Accounting system, customer database, shared files, email, and the configuration of key systems. Decide how much data you can afford to lose (a day? an hour?) and how fast you need it back.
2. Pick a backup tool that supports immutability. Most mainstream business backup products can write to object-locked cloud storage or a hardened repository. Ask your provider directly: "Can an admin with full rights delete these backups?" The right answer is no.
3. Set a sensible retention period. Attackers can sit quietly for days or weeks before striking. Keep at least a few weeks of locked restore points so you can go back to a clean one.
4. Separate backup credentials. Use different accounts, with MFA, for backup management. Don't join the backup server to your normal Windows domain if you can avoid it. This follows the zero trust idea of not trusting anything by default.
5. Back up your cloud apps too. Microsoft 365 and Google Workspace keep your data running, but their built-in retention isn't the same as an independent backup.
6. Test restores regularly. Restore a few files every month and a whole system at least once or twice a year. Time it.
7. Write it into your plan. Your cyberattack response plan should say who restores what, in which order.

What immutable backups don't do

Immutable backups help you recover. They don't stop the attack, and they don't stop data theft. Many ransomware groups now copy your data before encrypting it and threaten to leak it.

So you still need prevention: MFA, patching, and limiting access. And if personal data was taken, you may have PDPA notification duties, covered in the data breach guide.

Conclusion

Attackers target backups because backups are what let you say no. Immutable backups, locked so that even a stolen admin password can't delete them, keep that option open. Follow 3-2-1-1-0, keep backup credentials separate, and test your restores until they're boring.

Quick answers

What is an immutable backup?

A backup copy that can't be changed or deleted for a set retention period, even by an administrator. It protects you if attackers steal admin passwords.

Is OneDrive or Google Drive a backup?

Not on its own. Sync tools copy changes, including encrypted files, across devices. Version history helps, but you should still keep an independent backup.

How long should immutable backups be kept?

Long enough to go back to a point before the attacker got in. At least a few weeks of locked restore points is a common starting point; adjust for your business and any legal retention rules.

Do immutable backups stop ransomware?

They don't stop the attack, but they let you restore without paying. You still need prevention and a response plan for stolen data.