Total Defense makes internet security easy for you and tough on destructive malware. We don’t just protect devices, we protect people.

Ransomware can turn family photos, tax records, schoolwork, and important documents into unreadable files within minutes. Criminals encrypt the data, demand payment for a decryption key, and may threaten to publish stolen information.

Regular backups give you another recovery option. If ransomware damages the files on your computer, you may be able to wipe the device and restore clean copies instead of depending on the attacker.

What is ransomware?

Ransomware is malicious software that encrypts files or systems and demands payment to restore access. The Cybersecurity and Infrastructure Security Agency’s #StopRansomware Guide explains that modern criminals may also steal data before encrypting it, then threaten to release the information publicly. This tactic is commonly called double extortion.

Ransomware commonly spreads through:

• Phishing emails and malicious attachments
• Compromised or reused passwords
• Fake software downloads
• Unpatched applications or operating systems
• Malicious advertisements
• Infected external drives
• Unauthorized remote access

Why are backups important during a ransomware attack?

A reliable backup can provide a clean copy of files that ransomware made inaccessible. Instead of treating the attacker’s decryption offer as the only recovery path, you may be able to securely erase the infected device, reinstall its software, and restore your files.

Backups also protect against problems beyond ransomware, including:

• Hardware failure
• Lost or stolen devices
• Accidental deletion
• File corruption
• Failed software updates
• Fire, flooding, or physical damage

However, a backup does not prevent ransomware from infecting a device. It also cannot undo the exposure of data that criminals stole before encryption. Think of backups as an essential recovery layer within a larger security plan.

What did the Colonial Pipeline attack teach us?

On May 7, 2021, Colonial Pipeline proactively shut down its pipeline system in response to a ransomware attack. The system restarted on May 13, according to the U.S. Department of Energy’s incident summary. [energy.gov]

The Federal Bureau of Investigation confirmed that DarkSide ransomware compromised Colonial Pipeline’s networks. The incident demonstrated how ransomware can disrupt operations far beyond the initially compromised computers.

The ransomware threat remains active. The FBI’s 2025 Internet Crime Report says the Internet Crime Complaint Center received almost 3,000 cybercrime complaints per day in 2025. That figure covers many forms of cybercrime, not ransomware alone, but it illustrates the scale of the broader threat environment.

What is the best backup strategy for ransomware?

Follow the 3-2-1 backup rule:

• Keep three copies of important data, including the original.
• Store those copies on two different types of storage.
• Keep one copy offline or physically separate from the main device.

For example, keep the working files on your laptop, an encrypted copy on an external drive, and another copy in a reputable cloud-backup service.

The offline copy matters because ransomware may encrypt connected external drives and synchronized cloud folders along with the computer. Disconnect an external drive after the backup finishes, rather than leaving it attached continuously.

How do you build safer backups step by step?

Identify what you cannot afford to lose

Start with irreplaceable and high-value files:

• Family photos and videos
• Financial and tax records
• School or work documents
• Password-manager recovery information
• Medical and insurance records
• Creative projects
• Device configurations

Avoid backing up unnecessary downloads or potentially suspicious files.

Choose two backup destinations

Use a combination such as:

• An external hard drive or solid-state drive
• A trusted cloud-backup provider
• Encrypted network storage
• A second computer that is not always connected

Cloud synchronization is not always the same as backup. If ransomware changes a synchronized file, that change may spread to the cloud. Look for a service with file versioning, deleted-file recovery, strong encryption, and multifactor authentication.

Automate a regular schedule

Back up active files daily or weekly, depending on how often they change. A backup from six months ago will not help recover yesterday’s work.

Set reminders to:

• Connect the offline drive
• Run the backup
• Confirm completion
• Safely eject the drive
• Store it securely

Test your recovery

A backup is useful only if you can restore it. Every few months, select several files and restore them to a separate folder. Open the files and confirm that they are complete and readable.

The CISA #StopRansomware Guide emphasizes preparation, response, and recovery rather than relying on prevention alone.

How can you protect the backups themselves?

Treat your backup account and storage devices as valuable assets:

• Use a unique password for the cloud-backup account.
• Enable multifactor authentication.
• Encrypt external drives.
• Disconnect local backup drives after use.
• Protect cloud accounts with separate administrator credentials.
• Keep at least one backup away from the primary device.
• Enable file version history or immutable backups when available.
• Never restore files until the infected system is clean.

Do not keep the only backup beside the computer if fire, flooding, or theft could affect both.

What should you do if ransomware appears?

If you see a ransom note or files suddenly become unreadable:

1. Disconnect the device from Wi-Fi, Ethernet, and shared storage.
2. Unplug external backup drives immediately.
3. Avoid deleting evidence or experimenting with encrypted files.
4. Photograph or record the ransom message.
5. Use a clean device to change exposed passwords.
6. Contact a trusted cybersecurity professional.
7. Report the incident to the FBI through IC3.
8. Erase and rebuild the device before restoring known-clean files.

Do not connect a healthy backup to a device that may still contain ransomware. Otherwise, the malware could encrypt the backup too.

How does creating backups help someone become safer online?

Backups reduce the leverage ransomware criminals have over you. They give you an independent recovery path and limit the disruption caused by encryption, accidental deletion, or device failure.

A strong backup plan helps someone become safer online by:

• Preserving important data when a device becomes unusable
• Reducing dependence on an attacker’s promises
• Supporting faster and cleaner recovery
• Protecting against hardware loss as well as cyberattacks
• Encouraging regular testing and stronger account security
• Keeping at least one copy beyond the ransomware’s reach

Ransomware backup checklist

Take these actions today:

• Identify your most important files.
• Create at least two backup copies.
• Keep one copy offline or physically separate.
• Protect cloud backups with multifactor authentication.
• Disconnect external drives when backups finish.
• Turn on file versioning where available.
• Test several restored files every few months.
• Keep devices updated and use reputable security software.
• Document how you would restore everything after an attack.

Backups cannot stop ransomware from arriving, and they cannot make stolen information private again. They can, however, prevent file encryption from becoming your only path forward.

Start with the files you would be devastated to lose. Back them up locally and in the cloud, disconnect the local copy, and test recovery regularly. A backup you have verified is one of the strongest defenses against ransomware’s disruptive power.

Traveling is fun. Losing access to your email, bank account, or phone while traveling? Not so much. Whether you’re heading out for a weekend trip or flying internationally, your devices carry a lot of sensitive information: photos, passwords, banking apps, work files, travel confirmations, and personal messages. A few simple cybersecurity habits can help protect […] Read More»