16/10/2026
Seven days of downtime, or under two. Same ransomware, same week.
The difference wasn't luck, and it wasn't anything either business did during the attack. It was a decision made months earlier about where the backups lived.
In the first case, the backups sat in the same environment as the servers. Reach one, you can reach the other.
In the second, they were kept separate and set up so they couldn't be changed or deleted for a set period. That gives you somewhere to recover from — though a backup still needs testing to be worth anything.
Worth asking whoever manages your IT: "Could someone with access to our main systems also change or delete our backups?"
Full comparison, including what detection looked like in each case — link in the comments.