Guide

Backups that survive ransomware: a guide for small businesses

Ransomware scrambles your files and asks for money to unscramble them. A good backup means you don't have to pay – as long as the ransomware couldn't reach it too.

Updated October 2026

How ransomware reaches backups

• Drives that are plugged in. To ransomware, a backup drive is just another drive.
• Network folders. Anything the PC can save to – a NAS, another PC's shared folder – it can scramble too.
• The next backup. A backup that runs after the files are scrambled copies the scrambled files over the good ones, unless it keeps the earlier copies.

Set up backups so a clean copy survives

1. Keep one copy unplugged and away – a second drive, swapped each week (see rotating backup drives). Ransomware can't reach a drive in a drawer at home.
2. Keep earlier versions of files that change, for at least a month – so a backup that ran after the damage still has the copies from before it.
3. Turn on your NAS's snapshots if you back up to one: read-only copies the PCs can't change.
4. Test a restore every few months, so you know how it's done before you need it.

If it happens

1. Unplug the PC from the network (cable and Wi-Fi), and don't plug in any backup drive.
2. Get help to clean the PC, or reinstall Windows. In Australia, report it through ReportCyber, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), 24 hours a day – from a phone or device that wasn't affected.
3. Only once the PC is clean, plug in the backup drive and restore. Restore to a new folder first, and check the files open, before replacing anything.