A ransomware note appeared on a home office computer on a Tuesday morning. The owner, a freelance accountant, felt a flash of relief instead of panic. She had a backup drive. She had been plugging it in every night for two years. Then she opened the drive and found that its files were encrypted too, alongside everything else on her network. The backup she trusted had failed at the exact moment she needed it.
A homeowner who learned the hard way that a full drive isn’t a recovery plan
That accountant’s mistake was not laziness. She was more diligent than most. The problem was that she had confused the act of copying files with the ability to recover them. Her drive stayed connected to the same machine that got infected, so the malware treated it like any other folder. When she finally called for help, the honest answer was that her only clean data was a six-month-old copy she had forgotten about on an old laptop.
The lesson generalizes well beyond one home office. A backup is not a thing you own. It is a process you can prove works. Owning storage full of data is easy. Being able to stand up your life or your business from that data after a real attack is a different discipline entirely.
Copies on the same network vs. truly isolated backups
Modern ransomware does not politely stop at the first computer it lands on. It crawls. It reaches for mapped drives, shared folders, and any storage it can authenticate to. A backup that lives on the same network, using the same credentials, is exposed to the same attack that ruined the originals.
Isolation is what separates a survivable backup from a decorative one. That can mean a drive that is physically disconnected except during the backup window, a cloud target that requires separate credentials and cannot be silently overwritten, or immutable storage that refuses to delete or alter files for a set retention period. The old rule of keeping three copies, on two kinds of media, with one held offline or off-site still holds up because it forces at least one copy out of the blast radius.
Set-and-forget schedules vs. verified, tested restores
Most backup failures are silent. A scheduled job quietly errors out for months, a drive fills up, a folder gets excluded after a software update, and no one notices because nothing forces them to look. The green checkmark says success while the archive slowly rots.
The only cure is testing. Actually restore files. Do it on a schedule, not just after a scare. Pick a random date, pull back a folder, and confirm it opens. Better still, attempt a full recovery to spare hardware so you learn how long it takes and what breaks along the way. A restore you have never rehearsed is a theory, not a plan.
Backing up files vs. backing up what it takes to rebuild
People instinctively back up documents and photos. Rebuilding a working system needs far more than that. Application settings, database contents, license keys, email archives, and the configuration that ties everything together are all part of the picture. If a business copies its customer records but not the software that reads them, recovery still stalls.
Think in terms of what it takes to be operational again, not just what files exist. Documenting your systems, versions, and dependencies is unglamorous work, but it is the difference between restoring in an afternoon and improvising for a week. Many organizations discover this gap only during a crisis, which is precisely the wrong time. Working through it in advance, sometimes with outside cybersecurity services, turns a vague sense of preparedness into an actual runbook someone can follow under pressure.
Cloud sync vs. real backup, and why they aren’t the same
File-syncing tools feel like backups, and across much of North America they are the default safety net for home users and small offices alike. But sync mirrors your current state. If a file is encrypted or deleted, the service faithfully replicates that change everywhere. Some platforms keep version history that can save you, yet retention windows are often short and quietly limited.
A real backup keeps point-in-time copies you can return to, protected from being overwritten by whatever just went wrong. Sync is convenience. Backup is recovery. Treating one as the other is exactly how a full drive turns into a false sense of security, right up until the morning it fails you.