// Key takeaway
Modern ransomware targets backups first. Protect them with immutable copies, a separate off-site location, separate credentials and regular restore tests.
Why backups get hit
Attackers who gain admin access look for backup systems and delete or encrypt them before launching ransomware, leaving victims no option but to pay.
Immutability
Immutable backups cannot be changed or deleted until their retention period ends, even by an administrator account. This is the single most important defence.
Separation
Keep at least one copy in a different location, managed with separate credentials, so a compromise of your main environment cannot reach it.
Retention
Attackers can sit undetected for weeks. Retain enough history, typically 30 to 365 days, to restore from before the intrusion began.
Testing
Restore tests prove backups work and tell you how long recovery really takes. We test restores monthly for managed customers.
Published 16 October 2026 by the Digital Hosting Services engineering team, York.
Want an engineer to look at your situation?
Get in touch