Ransomware recovery: backups that really work

Most businesses back up their data. Far fewer ask the question that decides ransomware recovery: if ransomware encrypts your systems, can you really recover from your backups, and how long will it take?

Ransomware is malicious software that encrypts a company's data and demands a ransom to unlock it. Simply having backups is not enough to beat it. What helps is a backup the attacker cannot reach and a recovery process you have already tested.

Czech businesses are no exception. According to ESET, 12 Czech victims appeared on ransomware groups' public leak sites in the first quarter of 2026, twice as many as in the same period of 2025. The real number of affected companies may be higher, as only publicly named victims are counted.

We are not saying this to scare anyone. Most of what decides how quickly you recover can be prepared in advance. Below you will find what a backup that survives an attack looks like, what RPO and RTO mean, a checklist for business owners and what to do in the first hour of an attack.

Why an ordinary backup is not enough against ransomware

Attackers go after the backups too

An attacker who gets into a company network knows that backups are your way out. That is why they often look for them first.

In a 2024 Sophos survey of 2,974 IT and cybersecurity professionals, 94% of organisations hit by ransomware said the attackers tried to compromise their backups, and 57% of those attempts succeeded. Organisations whose backups were compromised had median overall recovery costs eight times higher than those whose backups were not affected. A backup that the attacker deletes or encrypts along with everything else will not help you in a crisis.

Sync and a connected drive are not a backup

A shared cloud folder that syncs with everyone's computers is convenient. Encrypted files, however, sync to it just as quickly as normal changes. The same goes for an external drive or a network storage device (NAS) that stays permanently connected and is accessible with the same account used for everyday work.

A backup is a copy of data that can be restored to a specific point in time and that neither everyday operations nor an attacker with ordinary permissions can overwrite. If your ‘backup’ does not meet that standard, it is really just a second copy of your data.

The 3-2-1-1 rule: what a backup that survives an attack looks like

The Czech National Cyber and Information Security Agency (NÚKIB) recommends the 3-2-1 backup rule: at least three copies of your data, on two different types of media, with at least one copy kept off-site. It is a solid foundation against fire, theft and disk failure.

For ransomware protection, one more ‘1’ is added: at least one copy should be offline or immutable. ESET recommends keeping backups physically and logically separated from the production network. That gives you the 3-2-1-1 rule.

You may also come across the 3-2-1-1-0 variant. The zero stands for zero errors when verifying a restore, meaning you have actually tried restoring from the backup and it worked.

Setting up server and business data backups along the lines of the 3-2-1-1 rule is part of our server and infrastructure management.

Separated and immutable backups keep the attacker out

What an offline (air-gapped) backup means

An offline backup (also called air-gapped) is a copy that is not permanently connected to the network. Typically it is a disk or tape that is disconnected after the backup runs and stored elsewhere. CISA recommends keeping backups offline and encrypted. The downside is the manual work, and with it the risk that someone forgets to disconnect it.

What an immutable backup means

An immutable backup is a copy that cannot be deleted or overwritten for a set period, not even with ordinary administrator rights. The lock is enforced by the storage itself, for example cloud object storage with a locking feature. Unlike an offline backup, it works automatically and does not rely on anyone remembering.

Separate access: one account for backups, another for daily operations

Backups should have their own account and a different password from everyday systems, ideally with two-factor authentication. If an attacker steals the server administrator's password, that alone should not give them access to the backups. We cover how to set up and monitor access in our article on business access management.

RPO and RTO: how much data you can afford to lose and how long you can be down

RPO (Recovery Point Objective) is how much work, going backwards, you can afford to lose. If you back up once a night and the attack comes in the afternoon, you may lose up to a day of work: orders, invoices, changes in your CRM.

RTO (Recovery Time Objective) is how quickly you need to be up and running again. It is the time from the outage to the moment the system is serving your staff and customers again.

Imagine a hypothetical online shop whose orders are linked to stock and accounting. Losing a day of orders means tracing payments by hand and apologising to customers, so the owner may want an RPO measured in hours. If the shop cannot be down for more than one working day, the whole recovery has to fit within that time. This is a hypothetical example, not a description of a client project.

Both numbers are set by the business, not by the technician. The technician then uses them to design the backup strategy: how often to back up and what kind of recovery to choose. RPO and RTO are also the starting brief for disaster recovery, the plan for getting back on your feet after a serious outage. Who responds to an outage, and how quickly, also belongs in your support contract; see our article on the application support SLA.

A restore test is the only proof that a backup works

A backup you have never restored from is just an assumption. Only a test shows whether the data is complete, whether you have the passwords and encryption keys, and how long recovery really takes.

NÚKIB recommends having a contingency plan that sets out how recovery from backups will work. ESET and CISA both advise regular backup testing to confirm that backups can actually be restored.

Test the whole system, not just a single file. For a web application or online shop, that means restoring the database, files and configuration to a separate server and checking that the application runs and the data is correct. Then compare the time it took with your RTO.

We recommend testing a restore at least once a quarter and after every major change to the system, such as a migration or upgrade. This is our recommendation, not a formal standard. What matters is that the test has a named owner: who runs it, when, and where the result is recorded.

For business applications and databases, recovery needs someone who knows the application. A server administrator can restore the machine, but checking that the application works properly afterwards is usually a job for application support.

Checklist for business owners: 10 questions for your IT administrator or supplier

For each question, they should be able to answer ‘yes’ and show you how they know.

1. Do we know which systems and data are backed up, including databases, email and our CRM?
2. Do we have at least three copies of our data, one of them off-site?
3. Is at least one copy offline or immutable?
4. Do the backups have their own account and password with two-factor authentication, separate from everyday systems?
5. Have we set an RPO and RTO for our main systems, and does our backup frequency match them?
6. Have we tried restoring a whole system in the last quarter, and do we know how long it took?
7. Does someone get an alert when a backup fails?
8. Are the backups encrypted, and do we know where the keys are kept?
9. Do we have a written recovery procedure that someone other than one specific person could follow?
10. Do we know whom to call during an attack, and do we have their phone number outside our company systems?

If you cannot answer several of these, or you are not sure who took over the backups from your previous supplier, our article on taking over an application from another vendor can help.

What to do in the first hour of a ransomware attack

When a ransomware attack hits, the first hour is about staying calm and taking the right steps in the right order. This procedure is based mainly on the guide from the US agency CISA and does not replace your own incident response plan.

1. Disconnect affected computers and servers from the network. Unplug the cable or turn off Wi-Fi. If you can, do not power them down, as shutting down destroys evidence held in memory. Only power them off if you cannot disconnect them.
2. Do not delete or fix anything yourself. Do not run clean-up tools or reinstall systems. You would lose evidence and could damage the data.
3. Call your IT administrator or supplier. Use the phone or another channel outside the affected systems, as the attacker may be able to read company email.
4. Check that your backups are intact and disconnect them. If any backup is connected to the network, disconnect it before the ransomware reaches it.
5. Report the attack. Contact the police. In the Czech Republic, providers of regulated services under the Cyber Security Act (No. 264/2025 Coll.) must also report incidents within the scope the act sets, to NÚKIB or to the National CERT depending on their obligation regime. Other organisations can report an incident to NÚKIB voluntarily. Check in advance whether the obligation applies to you, not during the attack.
6. Do not pay the ransom without advice. NÚKIB generally advises against paying a ransom, and the US agencies CISA and FBI strongly discourage it. Paying does not guarantee that you will get your data back or that the attacker will not publish it. The decision ultimately rests with the organisation, so do not make it without experts and the police.
7. Restore from a verified backup, and only into a cleaned environment. CISA warns that before rebuilding from backups you need to find and remove any malware the attacker left in the network. Otherwise the attack may happen again.

No in-house administrator and need help right now? Use our urgent programmer help. We are available every weekday from 8:00 to 20:00.

How we can help with backups and ransomware recovery

1. Web IT, with offices in Prague and Brno, develops custom web applications and systems and looks after their day-to-day running. As part of our server and infrastructure management, we set up regular backups, secure access and outage monitoring.

We do not just look after servers; we also understand the applications and databases that run on them. We will find out how you back up today and where the risks are, and propose a setup based on the RPO and RTO that make sense for your business.

Not sure when anyone last tried restoring from a backup? Get in touch. We will reply within 1 working day and agree how to go through your backups and recovery together.

Frequently asked questions

Do backups protect a business from ransomware?

Backups do not stop ransomware from encrypting your data, but they let you recover after an attack without paying a ransom. The condition is that at least one copy is separated or immutable, so the attacker cannot delete or encrypt it. The recovery also has to be tested.

What is the 3-2-1-1 backup rule?

Three copies of your data, on two different types of storage, one off-site and one offline or immutable. The 3-2-1-1-0 variant adds a zero for a verified restore with no errors.

What do RPO and RTO mean?

RPO (Recovery Point Objective) is how much data, going backwards, a business can afford to lose, for example the last day's work. RTO (Recovery Time Objective) is how quickly the system must be running again. These two numbers determine how often you need to back up and how fast your recovery has to be.

How often should you test backup restores?

Restores should be tested regularly and after every major change to the system, not just once when backups are first set up. We recommend at least once a quarter; this is our recommendation, not a formal standard. Test the whole system including the database, not just a single file.

What should you do first in a ransomware attack?

Disconnect the affected computers and servers from the network, but if possible do not power them down, so that evidence is preserved for the investigation. Call your IT administrator or supplier straight away and communicate outside the affected systems. Do not pay the ransom without expert advice.

Want to be sure you can recover after an attack? See what our server and infrastructure management covers, or simply get in touch. We will go through your backups, RPO and RTO and propose how to verify your recovery regularly.