--- title: Ransomware Recovery | SUMāTO description: "Why many backups fail against ransomware: immutability, isolation, the 3-2-1 rule, and testing. By Andrés Lozada, SUMāTO." image: https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png --- [Skip to content](https://sumatogroup.com/en/insights/blog/recuperacion-ante-ransomware#main-content) - [INSIGHTS](https://sumatogroup.com/en/insights) - [SUPPORT](https://sumatogroup.com/en/support) - [CONTACT](https://sumatogroup.com/en/contact) EN [Español](https://sumatogroup.com/insights/blog/recuperacion-ante-ransomware) [English](https://sumatogroup.com/en/insights/blog/recuperacion-ante-ransomware) [![SUMāTO Group — home](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SMT%20-%20LOGO.png?width=40&height=40&name=SMT%20-%20LOGO.png)](https://sumatogroup.com/en) - [HOME](https://sumatogroup.com/en/) - About #### SUMāTO - [About us→](https://sumatogroup.com/en/about-us) - [Terms→](https://sumatogroup.com/en/legal) - [Legal→](https://sumatogroup.com/en/legal) - [Cookies→](https://sumatogroup.com/en/legal) - [Data protection→](https://sumatogroup.com/en/legal) #### METHODOLOGIES - [Design Thinking→](https://sumatogroup.com/en/methodologies#design-thinking) - [Lean Startup→](https://sumatogroup.com/en/methodologies#lean-startup) - [PMI→](https://sumatogroup.com/en/methodologies#pmi) - [Scrum→](https://sumatogroup.com/en/methodologies#scrum) #### Vendors - [AWS→](https://sumatogroup.com/en/vendors#aws) - [Cisco→](https://sumatogroup.com/en/vendors#cisco) - [Dahua→](https://sumatogroup.com/en/vendors#dahua) - [Fortinet→](https://sumatogroup.com/en/vendors#fortinet) - [Huawei→](https://sumatogroup.com/en/vendors#huawei) - [Microsoft→](https://sumatogroup.com/en/vendors#microsoft) - [OCI→](https://sumatogroup.com/en/vendors#oci) - [Panduit→](https://sumatogroup.com/en/vendors#panduit) - Capabilities #### TECHNOLOGY - [Artificial Intelligence→](https://sumatogroup.com/en/artificial-intelligence) - [Data Analytics→](https://sumatogroup.com/en/data-analytics) - [Automation→](https://sumatogroup.com/en/automation-rpa) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity) - [Cloud→](https://sumatogroup.com/en/cloud) #### SEGMENTS - [SMB→](https://sumatogroup.com/en/smb) - [Enterprise→](https://sumatogroup.com/en/enterprise) - [Government→](https://sumatogroup.com/en/government) - Consulting #### Assessments - [AI Readiness→](https://sumatogroup.com/en/ai-readiness-assessment) - [Analytics→](https://sumatogroup.com/en/data-analytics-maturity-assessment) - [Cloud→](https://sumatogroup.com/en/cloud-readiness-assessment) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity-assessment) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-assessment) - [IT Maturity→](https://sumatogroup.com/en/it-maturity-assessment) - [IT Strategy→](https://sumatogroup.com/en/technology-strategy-assessment) - [Process Automation→](https://sumatogroup.com/en/process-automation-assessment) #### Consulting & Architecture - [AI First→](https://sumatogroup.com/en/ai-first) - [BCP→](https://sumatogroup.com/en/business-continuity-plan) - [DRP→](https://sumatogroup.com/en/disaster-recovery-plan) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-togaf) - [Enterprise Transformation→](https://sumatogroup.com/en/enterprise-transformation) - [IT Strategic Plan→](https://sumatogroup.com/en/it-strategic-plan) - [Strategic Consulting→](https://sumatogroup.com/en/strategic-consulting) - Operations #### INFRASTRUCTURE - [Data Center→](https://sumatogroup.com/en/data-center) - [Managed Services→](https://sumatogroup.com/en/managed-services) - [VDI→](https://sumatogroup.com/en/vdi) - [Intelligent Video Surveillance→](https://sumatogroup.com/en/video-surveillance) #### SECURITY - [NOC→](https://sumatogroup.com/en/noc) - [SOC→](https://sumatogroup.com/en/soc) #### USERS - [Modern Desktop→](https://sumatogroup.com/en/modern-desktop) - [Help Desk→](https://sumatogroup.com/en/help-desk) - Industries Industries - [Banking & Finance→](https://sumatogroup.com/en/banking-finance) - [Insurance→](https://sumatogroup.com/en/insurance) - [Government→](https://sumatogroup.com/en/government) - [Healthcare→](https://sumatogroup.com/en/healthcare) - [Telecommunications→](https://sumatogroup.com/en/telecommunications) - [Retail & Consumer→](https://sumatogroup.com/en/retail) - [Manufacturing→](https://sumatogroup.com/en/manufacturing) - [Energy, Oil & Gas→](https://sumatogroup.com/en/energy-oil-gas) - [Education→](https://sumatogroup.com/en/education) - [Logistics & Transportation→](https://sumatogroup.com/en/logistics-transport) - [Legal Services→](https://sumatogroup.com/en/legal-services) - [Engineering & Construction→](https://sumatogroup.com/en/engineering-construction) - Resources #### CONTENT - [Blog→](https://sumatogroup.com/en/insights) - [Use cases→](https://sumatogroup.com/en/use-cases) #### EVENTS - [Webinars→](https://sumatogroup.com/en/webinars) EN [Español](https://sumatogroup.com/insights/blog/recuperacion-ante-ransomware) [English](https://sumatogroup.com/en/insights/blog/recuperacion-ante-ransomware) Search - There are no suggestions because the search field is empty. [Continuidad y Resiliencia](https://sumatogroup.com/en/insights/tag/continuidad-y-resiliencia) # Ransomware Recovery: Backups That Actually Work [Andrés Lozada](https://sumatogroup.com/en/insights/author/andres-lozada) · Jun 16, 2021, 8:00:00 AM · 7 min read The email lands on an ordinary Tuesday: encrypted files, a ransom note, and a clock counting down. In that moment, the question that decides the outcome is not how much the ransom costs, but a far more uncomfortable one: can we restore everything from a backup we know is clean? Too many organizations discover, at exactly that instant, that their backups were encrypted too. Having backups is not the same as having recovery. **The short version:** Modern ransomware seeks out and attacks your backups first. A backup only helps you recover if it is immutable, isolated from the production network, and exists in multiple copies (the 3-2-1 rule). And none of that counts if you have never tested a full, end-to-end restore. ## Why so many backups fail exactly when they are needed most For years, backup was designed with hardware failures, accidental deletions, or physical disasters in mind. Ransomware changed the rules: it is no longer a random event but an adversary that studies your infrastructure before acting. Attackers know your best defense is the backup, so they make it their first target. Among the most common causes of failure we find: - **Network-connected backups:** if the backup repository is reachable with the same credentials as the rest of your servers, it gets encrypted just like everything else. - **Shared credentials:** a compromised administrator account opens the door to production and to backup at the same time. - **Slow, silent encryption:** some attacks corrupt data for weeks before detonating, contaminating every recent restore point. - **Copies that were never tested:** the backup "completed successfully" every night, but no one verified that the data was actually recoverable. The result is always the same: the copy exists, but it is useless. Recovery requires designing backup on the assumption that the attacker will try to destroy it. ## Immutability: copies that cannot be deleted or encrypted Immutability means that, once written, a backup cannot be modified or deleted for a defined period, not even by an administrator with valid credentials. It is the difference between "I have copies" and "I have copies the ransomware cannot touch." There are several ways to achieve it: - **WORM storage** (write once, read many), where data is written a single time and is protected against being overwritten. - **Object lock** in object storage, which locks the file version for a set period. - **Enforced retention** that prevents shortening or deleting the retention period, even with privileged access. The key is that protection does not rely solely on good intentions or on a permission that can be revoked. If a compromised operator can delete the copy, that copy is not truly immutable. ## Isolation and air gap: separating backup from the line of fire Isolation means keeping at least one copy out of the direct reach of the production network. The classic concept is the **air gap**: a gap of air between your live data and your backup, so that an attack spreading across the network finds no path to the copies. The traditional air gap was tapes stored physically offline. Today several approaches coexist: - **Physical air gap:** disconnected media stored separately, with no possible network route. - **Logical air gap:** repositories accessible only during the backup window and disconnected the rest of the time, with separate credentials and domains. - **Isolated cloud copy:** an external destination, with independent authentication, that shares neither the directory nor the keys of your primary environment. The guiding principle is simple: if your production and your backup are compromised with the same key, you don't have two defenses, you have one—plus a useless copy. ## The 3-2-1 rule, and why it falls short today The 3-2-1 rule is still the soundest starting point for thinking about backup: - **3** copies of your data (the original and two backups). - **2** different media or technology types, so you don't depend on a single point of failure. - **1** copy off-site, physically separated from your primary location. Against ransomware, many organizations extend it to **3-2-1-1-0**: they add **1** immutable or isolated (offline/air-gapped) copy and demand **0** errors in recovery tests. The idea is not to memorize numbers, but to understand that copy diversity and physical or logical separation are what break the attacker's ability to destroy everything at once. ## Restore to a trusted point, not just the most recent one When the attack detonates, the instinct is to restore the newest copy. But if the ransomware had been silently encrypting or corrupting data for weeks, the most recent copy may already be contaminated. Recovering well means identifying a **trusted restore point**: the last state known to be clean. To do that you need: - **Sufficient retention:** keeping restore points that go back beyond the possible infection window, not just the last few days. - **Versioning:** multiple versions over time that let you roll back to before the compromise. - **Analysis capability:** being able to inspect a copy in a safe, isolated environment before returning it to production, so you don't reinfect yourself during recovery itself. Recovery is also a decision about time. Your **RPO** (how much data you can afford to lose) and **RTO** (how quickly you must be back in operation) objectives determine how often you back up and how fast you can come back online. A solution like [disaster recovery (DRaaS)](https://sumatogroup.com/cloud) is designed to replicate and orchestrate recovery with those objectives in mind. ## Recovery testing: the backup you never restored does not exist An untested backup is a hypothesis, not an insurance policy. The only way to know you can recover is to rehearse it, regularly and realistically. Tests should answer with data, not assumptions: - **Does it restore completely?** Opening a sample file is not enough; you have to bring up systems and applications end to end. - **How long does it take?** Time the real restore and compare it against your committed RTO. - **With how much data loss?** Verify that the recovered point respects your RPO. - **Who does what?** The people and roles must be as rehearsed as the technology. These tests are the heart of a well-governed disaster recovery plan. If you want to structure that plan, its scope, and its testing cadence, our [disaster recovery plans](https://sumatogroup.com/drp) practice helps take it from theory to something verifiable. ## Frequently asked questions ### Why does ransomware also encrypt my backups? Because attackers know the backup is your way out without paying. If the copies are on the network with accessible credentials, they encrypt or delete them along with production. That is why immutability and isolation are now part of basic design, not a luxury. ### Is having backups in the cloud enough? The cloud helps only if that copy is genuinely isolated: with independent authentication, immutability enabled, and separated from your primary environment's directory. A cloud copy reachable with the same compromised keys gets encrypted like any network folder. ### How often should I test recovery? Often enough to have confidence before you need it, and every time your infrastructure or critical systems change significantly. What matters is that the test be complete and measured against your RTO and RPO objectives, not a superficial check. ### What is the difference between backup and disaster recovery? Backup is the copy of the data; disaster recovery is the ability to resume operations using those copies, with defined processes, roles, and timeframes. Having the first without the second is exactly what fails when the attack arrives. ## The first step Don't wait for the Tuesday of the encrypted email to find out whether your copies work. The first step is honest and concrete: check whether your current backups are immutable, whether at least one copy is isolated from production, and whether they have ever been restored end to end. If the answer to any of those questions is "I'm not sure," there is your gap. At **SUMāTO** we help organizations across LATAM design backup and recovery that withstand ransomware, rather than merely appearing to. [Let's talk about your recovery plan](https://sumatogroup.com/contacto) and turn your copies into a reliable way out. Continue reading - [The Blurred Perimeter: Cybersecurity in Remote Work](https://sumatogroup.com/en/insights/blog/perimetro-difuso-ciberseguridad) - [SOC: 24/7 Watch When Everything Is Distributed](https://sumatogroup.com/en/insights/blog/soc-vigilancia-distribuida) Next step How much can your operation lose before it recovers? Measure it before the incident. [Cybersecurity Assessment →](https://sumatogroup.com/en/cybersecurity-assessment) [Continuidad y Resiliencia](https://sumatogroup.com/en/insights/tag/continuidad-y-resiliencia) ![Andrés Lozada](https://sumatogroup.com/hs-fs/hubfs/SPEAKERS/AL.jpeg?width=56&height=56&name=AL.jpeg) Andrés Lozada Jun 16, 2021, 8:00:00 AM [LinkedIn](https://www.linkedin.com/in/andreslozada/) ### Explore more from SUMāTO [Enterprise AI](https://sumatogroup.com/en/artificial-intelligence) [Enterprise Transformation](https://sumatogroup.com/en/enterprise-transformation) [Strategic Consulting](https://sumatogroup.com/en/strategic-consulting) [AI Agent](https://sumatogroup.com/en/artificial-intelligence) [AI Contact Center](https://sumatogroup.com/en/artificial-intelligence) [Cybersecurity](https://sumatogroup.com/en/cybersecurity) ### Related Posts #### [Operational Resilience: DR as a Service (DRaaS)](https://sumatogroup.com/en/insights/blog/draas-resiliencia) A decade ago, recovering from an IT disaster meant maintaining a second data center full of standby servers, powered on twenty-four hours a day,... #### [Ransomware Against Critical Infrastructure: The Lesson of a Halted Pipeline](https://sumatogroup.com/en/insights/blog/ransomware-infraestructura-critica) On May 7, 2021, one of the most significant fuel pipelines in North America shut down its operation. It was not a mechanical failure or a physical... #### [Operational Resilience: Lessons from the July Outage](https://sumatogroup.com/en/insights/blog/resiliencia-operativa-leccion) In the early hours of July 19, 2024, millions of screens across airports, hospitals, banks and data centers turned blue. A single faulty update was... ![SUMāTO](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png?width=200&height=100&name=SUM%C4%81TO%20%7C%20LOGO%201000x500.png) Strategic technology planning consultants. AI, Analytics, Cloud and Cybersecurity ## Navigation [Home](https://sumatogroup.com/en) [Capabilities](https://sumatogroup.com/en/artificial-intelligence) [Consulting](https://sumatogroup.com/en/strategic-consulting) [Operations](https://sumatogroup.com/en/managed-services) [Industries](https://sumatogroup.com/en/banking-finance) [Resources](https://sumatogroup.com/en/insights) ## SUMāTO [About](https://sumatogroup.com/en/about-us) [Terms](https://sumatogroup.com/en/legal#terminos) [Legal & Privacy](https://sumatogroup.com/en/legal) [Data protection](https://sumatogroup.com/en/legal) Cookies ## [Contact](https://sumatogroup.com/en/contact) [sales@sumatogroup.com](mailto:sales@sumatogroup.com) Mexico HQ Mexico City, Mexico [+52 55 8897 5791](tel:+525588975791) Bogotá Bogotá, Colombia [+57 601 724 5059](tel:+576017245059) © 2026 SUMāTO Group. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Andrés Lozada", "url" : "https://sumatogroup.com/en/insights/author/andres-lozada" }, "dateModified" : "2026-07-09T19:22:46.979Z", "datePublished" : "2021-06-16T13:00:00.000Z", "headline" : "Ransomware Recovery | SUMāTO", "mainEntityOfPage" : { "@id" : "https://sumatogroup.com/en/insights/blog/recuperacion-ante-ransomware", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://sumatogroup.com/hubfs/BRANDING/Logo_SUMATO_Original%20-%201000x500.png" }, "name" : "SUMāTO Group" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Because attackers know the backup is your way out without paying. If the copies are on the network with accessible credentials, they encrypt or delete them along with production. That is why immutability and isolation are now part of basic design, not a luxury." }, "name" : "Why does ransomware also encrypt my backups?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The cloud helps only if that copy is genuinely isolated: with independent authentication, immutability enabled, and separated from your primary environment's directory. A cloud copy reachable with the same compromised keys gets encrypted like any network folder." }, "name" : "Is having backups in the cloud enough?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Often enough to have confidence before you need it, and every time your infrastructure or critical systems change significantly. What matters is that the test be complete and measured against your RTO and RPO objectives, not a superficial check." }, "name" : "How often should I test recovery?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Backup is the copy of the data; disaster recovery is the ability to resume operations using those copies, with defined processes, roles, and timeframes. Having the first without the second is exactly what fails when the attack arrives." }, "name" : "What is the difference between backup and disaster recovery?" } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "alternateName" : [ "SUMāTO Group", "SUMATO Group", "Sumato Group", "SUMATO", "SUMaTO", "SUMaTO Group", "SUMTO", "SUMTO Group" ], "areaServed" : [ { "@type" : "Country", "name" : "México" }, { "@type" : "Country", "name" : "Colombia" }, { "@type" : "Place", "name" : "Latinoamérica" } ], "contactPoint" : { "@type" : "ContactPoint", "areaServed" : "Latinoamérica", "availableLanguage" : [ "es", "en" ], "contactType" : "sales", "email" : "sales@sumatogroup.com" }, "description" : "SUMāTO is a Latin American technology consulting and integration firm founded in 2016, with a presence in Mexico and Colombia. It designs, implements and operates artificial intelligence, data analytics, automation, cybersecurity and cloud on the systems a client already runs, under governance frameworks such as NIST AI RMF and ISO/IEC 42001.", "foundingDate" : "2016", "knowsAbout" : [ "Inteligencia Artificial", "IA Generativa", "Agentes de IA", "Analítica de Datos", "Big Data", "Automatización de Procesos (RPA)", "Ciberseguridad", "Computación en la Nube", "Continuidad del Negocio y Recuperación ante Desastres", "Arquitectura Empresarial", "Transformación Digital" ], "legalName" : "SUMāTO Group", "location" : [ { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "name" : "SUMāTO MX", "telephone" : "+52 55 8897 5791" }, { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "CO", "addressLocality" : "Bogotá", "streetAddress" : "Cra. 45 # 103-34, Of. 202" }, "name" : "SUMāTO CO", "telephone" : "+57 601 724 5059" } ], "logo" : { "@type" : "ImageObject", "height" : 500, "url" : "https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png", "width" : 1000 }, "name" : "SUMāTO", "sameAs" : [ "https://www.linkedin.com/company/sumatogroup", "https://www.youtube.com/@sumatogroup", "https://torre.ai/teams/SUMaTOGroup", "https://www.cbinsights.com/company/sumto-group", "https://elioplus.com/profiles/channel-partners/57295/sumato-group" ], "telephone" : "+52 55 8897 5791", "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#website", "@type" : "WebSite", "description" : "Technology consulting in AI, data, automation, cybersecurity and cloud across Latin America.", "inLanguage" : "en", "name" : "SUMāTO", "publisher" : { "@id" : "https://sumatogroup.com/#organization" }, "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://sumatogroup.com/en", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://sumatogroup.com/en/insights/blog/recuperacion-ante-ransomware", "name" : "Ransomware Recovery: Backups That Actually Work", "position" : 2 } ] } ```