Key Takeaways<\/p>\n
- \n
- Ransomware targets the backup.<\/strong> According to Sophos, attackers attempt to compromise backups in 94 percent of cases. Organizations that only protect against hardware failure are planning around the wrong threat model.<\/li>\n
- 3-2-1-1-0 closes the gap the old rule leaves open.<\/strong> An immutable copy and an offline copy put the backup out of an attacker’s reach. The zero stands for zero errors in the recovery test.<\/li>\n
- Without a restore test, there is no proof.<\/strong> A backup that has never been restored is not a reliable recovery path. Only regular restore tests reveal whether data, permissions, and dependencies actually work when it counts.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>The Edge Device as a Ransomware Entry Point<\/a> \/<\/span> NIS2 Is Now Being Enforced<\/a><\/p>\n
What is the 3-2-1-1-0 rule?<\/strong> This extended backup strategy follows a fixed pattern. Three copies of the data are stored on two different media types, one of them at a separate location. On top of that comes an immutable or offline copy, and the requirement that recovery must be tested with zero errors. It hardens the classic 3-2-1 rule specifically against ransomware.<\/p>\n
Why ransomware goes after backups first<\/h2>\n
A well-planned ransomware attack doesn’t encrypt immediately. It moves through the network first, locates backup systems, and disables them before touching production data. The logic is straightforward: a victim with an intact backup can restore. Without a reliable copy, the options narrow to payment, full rebuild, or data loss. The backup itself becomes the primary target.<\/p>\n
Incident data consistently reflects the same pattern. In the vast majority of cases, attackers actively attempt to compromise backups – and in more than half of those cases, they succeed. When the backup fails, recovery costs climb sharply because the fast path back no longer exists.<\/p>\n
\n94 Percent<\/div>\nof organizations hit by ransomware report that attackers deliberately attempted to compromise their backups.<\/div>\nSource: Sophos, State of Ransomware<\/div>\n<\/div>\nThat changes the requirement entirely. Having a backup is not enough. It must survive an attacker who is actively hunting for it. A backup system reachable with the same credentials as the rest of the network remains part of the compromisable infrastructure.<\/p>\n
What 3-2-1-1-0 demands beyond the original rule<\/h2>\n
The classic 3-2-1 rule dates from an era when data loss was primarily a technical event: a failed drive, a fire, an accidental deletion. Against those scenarios it still holds up. Against an attacker who is actively working through your infrastructure, it has a gap. The two additional digits close exactly that.<\/p>\n
\n - 3-2-1-1-0 closes the gap the old rule leaves open.<\/strong> An immutable copy and an offline copy put the backup out of an attacker’s reach. The zero stands for zero errors in the recovery test.<\/li>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/05\/cyber-haftung-foederalismus-illustration-250x140.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/06\/linux-kernel-luecken-bsi-update-dirty-frag-root-eskalation-2026-cover-hero-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/06\/14-boesartige-npm-pakete-in-vier-stunden-warum-statische-third-party-pruefung-nicht-mehr-reicht-cover-hero-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-platform-engineering-geschaeftskritische-78956570.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-ciso-compliance-under-nis2-67286561-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-stanford-ai-index-2026-inaccuracy-cybers-67641028-250x141.jpg\")
<\/span>