News · Academy · November 12, 2026

Academy: backups that survive ransomware

Ransomware is in 48% of breaches. What CISA says a backup must be: offline or locked, tested, and rebuildable, with a restore drill.

DRIVE 369 DAO · 2 min read

Academy, organisations, lesson 9. A backup that the attacker can reach is not a backup. This lesson is about copies that still exist on the worst day.

The facts

• Verizon's 2026 report finds ransomware in 48% of breaches (Verizon).
• The FBI received 3,611 ransomware complaints in 2025 with $32 million in reported losses, a figure it says is artificially low because many victims leave the loss blank (FBI IC3).
• The tracker ransomware.live lists 9,265 victims named by the criminals so far in 2026, about 29 a day. Check Point recorded 1,063 named in October, the highest it has seen.
• Mandiant measures the hand-off from the first intruder to a ransomware crew at a median of 22 seconds.

What CISA says a backup should be

From the #StopRansomware guide:

1. Offline and encrypted. Keep backups the network cannot reach, and test their availability and integrity regularly.
2. Golden images of your critical systems, ready to redeploy.
3. Infrastructure as code with offline copies of the templates, and source code and executables stored offline.
4. Spare hardware to rebuild on.
5. Immutable storage, used carefully. In the cloud, turn on delete protection or object lock. CISA warns that misconfigured immutability can be costly.
6. Your providers, too. Make any managed service provider follow the same backup practice by contract.

The rules in plain words

• Keep at least one copy offline or locked, so that stolen admin rights cannot erase it.
• Separate the backup system's credentials from the rest of your network.
• Know your restore order and how long it takes.
• Test the restore. A backup you have never restored is a hope.

A restore drill in an afternoon

1. Pick one critical system.
2. Restore it from backup to a clean machine, with a stopwatch.
3. Check that the data opens and the application works.
4. Write down what broke, and fix it before the real day.

How Ghostdrive approaches it

Your files in Ghostdrive are kept as sealed blocks on your devices and on nodes that must keep proving they hold them. If a node fails, the file is rebuilt from other copies. Your recovery words are the one thing to keep offline: store them on paper, not in a cloud note. Ghostdrive is a place for your private memory and files. It does not replace a tested backup of your company's servers.

Academy: start here · First 24 hours · How storage is checked