Are You Actually Backed Up? (Including the Cloud Stuff You Forgot)

Quick question. If ransomware locked every file tomorrow morning, how long until you're working again? If your answer starts with well, I think, you don't have backups. You have backup software.

The number that should scare you: 31 percent of businesses fail to recover their data from backups when ransomware hits, per Kaseya's backup-testing numbers. Not because they had no backup. Because the backup didn't work, and they found out at the worst possible moment.

1. The 10-minute restore test

Pick one file that matters. Restore it from backup into a different folder so you don't overwrite anything. Time it. That's the whole test. If one file takes an hour, your full restore in a crisis will take days, and now you know before it matters.

Do it quarterly. Put it on the calendar like an oil change. A backup nobody has ever restored is a rumor, not a plan.

2. The cloud stuff you forgot

Microsoft 365 and Google Workspace do not back up your data by default. Microsoft keeps the service running; recovering your deleted or encrypted files is your job under their shared responsibility model. Deleted mailboxes, wiped SharePoint folders, the ex-employee's OneDrive: all of it has retention limits most owners never configured.

Then the rest of the list: your website and its database, your online store's product data, your social media pages, and the phone in your pocket with the job-site photos and customer texts. If the only copy of something lives in a cloud account whose retention you never set, it's not backed up.

3. The 3-2-1 rule, in plain English

Three copies of anything that matters, on two different kinds of storage, with one copy somewhere an attacker can't reach. The classic version: your computer, an external drive, and the cloud. The 2026 version adds one word: immutable. A cloud copy that ransomware can encrypt is the same as no copy.

Note what doesn't count: a copy on the server plus a copy on the external drive sitting next to the server. One fire, one theft, one ransomware run takes both.

4. Ransomware changed the rules

Modern ransomware goes after your backups first. If it can reach them, it encrypts them, and then the ransom note is your only plan. The FBI's 2025 guidance says it plainly: keep backups off-site or offline, keep them encrypted, and make them immutable so they can't be changed or deleted inside a set window. An offline copy the attacker can't touch beats a fancy cloud dashboard every time.

5. What to ask your provider

When did you last test a full restore of our data? Show me the log. Where is the offline copy? If the answers are vague, you have homework, and now you know exactly what it is.

The test takes 10 minutes and costs nothing. Do it today, while someday is still an option.