Veeam finds 93% of cyberattacks target backup storage

Issue 4 2023 Information Security

Organisations of all sizes are increasingly falling victim to ransomware attacks and inadequately protecting against this rising cyberthreat. According to new data in the Veeam 2023 Ransomware Trends Report, one in seven organisations will see almost all (>80%) data affected as a result of a ransomware attack – pointing to a significant gap in protection.

Veeam Software found that attackers almost always (93%+) target backups during cyberattacks and are successful in debilitating their victims’ ability to recover in 75% of those events, reinforcing the criticality of immutability and air gapping to ensure backup repositories are protected.


Chris Norton.

The Veeam 2023 Ransomware Trends Report shares insights from 1200 impacted organisations and nearly 3000 cyberattacks, making it one of the largest reports of its kind. The survey examines key takeaways from these incidents, their impact on IT environments and the steps taken, or needed, to implement data protection strategies that ensure business resiliency. This research report encompasses four different roles involved in cyber-preparedness and/or mitigation including, security professionals, CISOs or similar IT executives, IT operations generalists, and backup administrators.

“The report shows that today it’s not about IF your organisation will be the target of a cyberattack, but how often. Although security and prevention remain important, it’s critical that every organisation focuses on how rapidly they can recover by making their organisation more resilient,” said Danny Allan, CTO at Veeam. “We need to focus on effective ransomware preparedness by focusing on the basics, including strong security measures and testing both original data and backups, ensuring survivability of the backup solutions, and ensuring alignment across the backup and cyber teams for a unified stance.”

Paying the ransom does not ensure recoverability

For the second year in a row, the majority (80%) of the organisations surveyed paid the ransom to end an attack and recover data – now up 4% compared to the year prior – despite 41% of organisations having a ‘Do-Not-Pay’ policy on ransomware. Still, while 59% paid the ransom and were able to recover data, 21% paid the ransom yet still didn't get their data back from the cyber criminals. Additionally, only 16% of organisations avoided paying ransom because they were able to recover from backups. Sadly, the global statistic of organisations able to recover data themselves without paying ransom is down from 19% in last year’s survey.

To avoid paying ransom, your backups must survive

Following a ransomware attack, IT leaders have two choices: pay the ransom or restore-from-backup. As far as recovery goes, the research reveals that in almost all (93%) cyber events, criminals attempt to attack the backup repositories, resulting in 75% losing at least some of their backup repositories during the attack, and more than one-third (39%) of backup repositories being completely lost.

By attacking the backup solution, attackers remove the option of recovery and essentially force paying the ransom. While best practices – such as securing backup credentials, automating cyber detection scans of backups, and auto verifying that backups are restorable – are beneficial to protect against attacks, the key tactic is to ensure that the backup repositories cannot be deleted or corrupted. To do so, organisations must focus on immutability. The good news is that based on lessons learned from those who had been victims – 82% use immutable clouds, 64% use immutable disks, and only 2% of organisations do not have immutability in at least one tier of their backup solution.

Do not re-infect during recovery

When respondents were asked how they ensure that data is ‘clean’ during restoration, 44% of respondents complete some form of isolated staging to re-scan data from backup repositories prior to reintroduction into the production environment. Unfortunately, that means that the majority (56%) of organisations run the risk of re-infecting the production environment by not having a means to ensure clean data during recovery. This is why it is important to thoroughly scan data during the recovery process.

Other key findings from the Veeam 2023 Ransomware Trends Report include:

Cyber-insurance is becoming too expensive: 21% of organisations stated that ransomware is now specifically excluded from their policies, and those with cyber insurance saw changes in their last policy renewals: 74% saw increased premiums, 43% saw increased deductibles, 10% saw coverage benefits reduced.

Incident response playbooks depend on backup: 87% of organisations have a risk management programme that drives their security roadmap, yet only 35% believe their programme is working well, while 52% are seeking to improve their situation, and 13% do not yet have an established programme. Findings reveal the most common elements of the ‘playbook’ in preparation against a cyberattack are clean backup copies and recurring verification that the backups are recoverable.

Organisational alignment continues to suffer: While many organisations may deem ransomware to be a disaster and therefore include cyberattacks within their business continuity or disaster recovery (BC/DR) planning, 60% of organisations say they still need significant improvement or complete overhauls between their backup and cyber teams to be prepared for this scenario.

“As data storage becomes increasingly complex, so too does the threat landscape and in turn, the threats of ransomware attacks significantly increase,” explained Chris Norton, Regional Director for Africa at Veeam Software. “Organisations need to be prepared against such a threat at all times, as it’s no longer a matter of ‘if’ or ‘when’, but rather, ‘how often’ when it comes to ransomware attacks. It’s important for businesses and their customers for them to position themselves to continue normal operations as quickly as possible. That way they’ll minimal losses to time, money, opportunities and most importantly, data.”

The full Veeam 2023 Ransomware Trends Report is available for download at https://www.veeam.com/ransomware-trends-report-2023




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.