When did your organization last restore a full production system from backup? Not a single file, but a real application, in the right order, against a clock.

For many organizations the honest answer is never. The backup job reports success every night and the dashboard stays green. That proves data is being copied. It does not prove the business could be running again within a week of a ransomware attack, and attackers understand that difference better than most defenders do.

Confidence Is Not a Capability

Two ideas get treated as one. Backup availability means a copy of the data exists. Recoverability means that copy can be restored, free of the attacker's access, onto systems that work, by people who know the order, within a time the business can survive. A backup can pass the first test and fail the second.

Veeam's 2026 Data Trust and Resilience Report, based on more than 900 senior IT, security, and risk leaders, measured the distance between them. Ninety percent said they were very or extremely confident they could recover within their recovery time objectives. Among those actually hit by ransomware, only 28 percent fully recovered all affected data, and 44 percent recovered less than three-quarters of it. The plans themselves were also out of step with the business: only 69 percent said their recovery time objectives were fully aligned with business continuity goals.

Speed is the other half of the problem. In Sophos's State of Ransomware 2026, a survey of 2,158 leaders at organizations hit by ransomware, two-thirds of victims with encrypted data recovered it from backup, which is encouraging. But average recovery time was roughly three weeks, and average cleanup cost excluding any ransom reached $1.7 million. The two surveys measure different things and should not be merged into one number. Read together, they say that getting some data back is common, getting all of it back quickly is not.

Three weeks of disruption is not a backup problem. It is a business problem.

Attackers Plan for Your Recovery Before They Announce Themselves

Ransomware operators do not encrypt first and look for backups later. They remove the backups first, because a victim who can restore has little reason to pay. Sophos's 2024 survey found that 94 percent of organizations hit by ransomware said attackers tried to compromise their backups, and the attempts succeeded 57 percent of the time. Veeam's 2023 report, based on 1,200 IT leaders, found the same pattern: backup repositories were targeted in 93 percent of attacks, and 39 percent of victims lost their repositories entirely. Both figures are older, and the exact percentages differ by survey, but the incident-response detail from this year shows how it happens.

Google Threat Intelligence Group's March 2026 analysis of ransomware cases Mandiant handled in 2025 documents the techniques:

Backup software is also a vulnerability target in its own right. CISA confirmed in October 2024 that CVE-2024-40711, a critical flaw in Veeam Backup & Replication, was being used in ransomware attacks, and the joint advisory on the Akira group describes it dumping credentials from the Veeam configuration database and deleting Volume Shadow Copies to inhibit recovery. The system built to rescue the business from an attack can become the way into it.

A Backup the Attacker Never Touched Can Still Fail

Even an intact backup can fail when it is needed, and the reasons are mostly operational.

The first is that a restore point may carry the intruder with it. Attackers often sit in a network for weeks or months before deploying ransomware. In the 2023 PhilHealth incident, a DICT official said preliminary analysis suggested the attackers had been inside since June, months before systems went down. Backups taken during that window may contain the attacker's persistence, and restoring one without checking recreates the problem. Veeam's 2023 survey found that only 44 percent of organizations re-scan data in an isolated staging environment before restoring it.

The second is dependencies. Restoring a database is not restoring a service. Applications need identity services, DNS, network paths, hypervisors, and encryption keys, and in a serious attack some of those are exactly what was compromised. A plan that lists the backups but not the order in which dependencies must return is a list of parts, not a plan.

The third is shared fate, and a live example is still unfolding. On October 7, 2026, IDC Frontier confirmed a ransomware attack that disrupted its IDCF Cloud service in Japan, affecting 495 companies and local governments. The company said customer data in the affected region is expected to be difficult to retrieve or restore, and advised customers to restore from their own backups, while urging them to verify that those backups exist. The investigation is ongoing, and claims about exactly what the attackers destroyed have not been verified. The lesson does not depend on those details: a copy that lives in the same environment, under the same credentials, shares that environment's fate.

Why This Matters for Philippine Organizations

Check Point Research found confirmed ransomware incidents against Philippine organizations nearly doubled in 2025, from 9 to 17, and Viettel Cyber Security's H1 2026 report recorded 21 ransomware incidents in the first six months alone. In September, the Qilin group claimed an attack on the Philippine Ports Authority.

These are incident counts, not backup statistics, and no Philippine-specific data on recovery readiness was available for this piece. The practical point is simpler: an organization that expects to be targeted should expect its backups to be targeted too, and should know before an attack how long a real recovery would take.

What to Validate Before a Crisis

None of this is an argument against backups. It is an argument for testing the properties that make a backup trustworthy. CISA's ransomware guidance is direct: organizations should maintain offline, encrypted backups of critical data and regularly test the availability and integrity of those backups in a disaster recovery scenario. In practice that becomes six questions worth answering before an incident forces them.

1. Can an attacker with a compromised domain account reach the backups? Backup infrastructure should not share administrative credentials, or an identity domain, with the environment it protects. If a stolen admin login that works on the file server also works on the backup console, the backup is part of the blast radius.

2. Is at least one copy immutable or offline? CISA's Akira advisory recommends backup data that is encrypted, immutable, and kept in a physically separate, segmented location.

3. Is the backup software patched and isolated? A critical Veeam flaw was exploited in real ransomware attacks, so backup servers deserve the patching urgency of internet-facing systems.

4. Has a full restore been timed, end to end? The test that matters is a complete system, in dependency order, measured against the downtime the business can tolerate, and repeated on a schedule.

5. Is restored data checked before it returns to production? Scanning in a staging environment is the difference between recovering and reinfecting.

6. Who holds the backups, and are they held to the same standard? CISA notes that if a third party runs the backups, the organization should confirm it follows the same practices.

Prove the Path, Then Prove the Recovery

These questions need two different kinds of testing, and they should not be confused. Questions 4 and 5 are answered by recovery exercises and disaster recovery drills. Only a restore can show whether the business comes back within its recovery time objective, and no penetration test can substitute for one.

Questions 1 through 3 are different. They ask whether an attacker who gets a foothold on an ordinary workstation can actually walk to the backup system, and the answer depends on credentials left in the wrong place, network paths nobody closed, unpatched backup software, and administrative access broader than anyone intended. Those are findings, not assumptions, and they tend to surface only when someone tries.

That is the part a penetration test is built for. Secuna Pentest applies manual, scoped testing to web applications, mobile apps, APIs, networks, and cloud infrastructure, working from the attacker's side to show how far an initial foothold can travel. Including backup infrastructure in the scope of a network or cloud engagement turns "we believe our backups are isolated" into something checked from an adversary's position, which is exactly the assumption attackers are counting on.

A backup tells you that your data was copied. Only testing tells you whether your business can come back, and the time to find out is before a ransomware group has already deleted the answer.

To learn more, reach out to our team at [email protected] or explore our services at secuna.io.

Sources: Data Trust and Resilience Report 2026, Veeam · Sophos State of Ransomware 2026: Ransom Demands Are Down, Email Is the Top Way Attackers Get In, Help Net Security · Ransomware Payments Increase 500% in the Last Year, Finds Sophos State of Ransomware Report, Sophos · Backup Repositories Targeted in 93% of Ransomware Attacks, Infosecurity Magazine · Almost All Ransomware Attacks Target Backups, Says Veeam, Computer Weekly · Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape, Google Threat Intelligence Group · CISA Confirms Veeam Vulnerability Is Being Used in Ransomware Attacks, The Record · #StopRansomware: Akira Ransomware, CISA, FBI and partners · Philippines State Health Org Struggling to Recover From Ransomware Attack, The Record · Ransomware Attack Disrupts Japan's IDCF Cloud Used by Govt Clients, BleepingComputer · Data Recovery Challenging After Ransomware Attack on IDCF Cloud, ASCII.jp · Phishing Sites in PH Jump 423% in 2025, Newsbytes.ph · Over 335M Records Breached as Cyber Attacks Rise in the Philippines in H1 2026, Technobaboy · Philippine Ports Authority Data Breach, Breachsense · #StopRansomware Guide, CISA