This Enterprise Techie episode covers how organizations get back from ransomware: the Jaguar Land Rover shutdown, Maersk’s NotPetya recovery, five layers of a recovery architecture, the current numbers and four ways backups fail. The single most useful takeaway: attackers target backups in most attacks, so a backup only counts if stolen admin credentials can’t delete it and a timed restore test has proven it works.
Watch the episode on YouTube: Ransomware Recovery Explained: Immutable Backups & Clean Rooms.
The video version uses an AI-generated voice of host David Davis, disclosed on YouTube.
In this brief
Why recovery decides the outcome
In late August 2025, a cyber incident at Jaguar Land Rover led to an IT shutdown and halted its global manufacturing, according to the Cyber Monitoring Centre (CMC). Vehicle production at its major UK plants was suspended for about five weeks. The CMC modeled the UK financial impact at £1.9 billion (range £1.6 billion to £2.1 billion), counted more than 5,000 affected UK organizations, and said the incident appears to be the most economically damaging cyber event to hit the UK. It attributes virtually all of that loss to operational disruption, which is why the episode focuses on recovery rather than on how attackers get in.
Attackers understand this. Veeam’s blog on its 2024 Ransomware Trends Report says bad actors targeted backup repositories in 96% of attacks; its 2025 report found 89% of organizations had their repositories targeted. In a March 2024 Sophos study of 2,974 organizations hit by ransomware, 94% said attackers tried to compromise their backups.
The Maersk story
On June 27, 2017, NotPetya hit Maersk as collateral damage in an attack aimed at Ukraine, as WIRED’s account describes it. Maersk then represented close to a fifth of the world’s shipping capacity. The paralysis reached 17 of its 76 terminals, and staff took orders through personal Gmail accounts, WhatsApp and Excel spreadsheets.
Maersk’s 150 or so domain controllers synced with one another so each could back up the others, a design that never accounted for all of them being wiped at once. One survived, in Ghana, because a blackout had knocked it offline before the attack, and its hard drive was relayed to Heathrow via Nigeria. Chair Jim Hagemann Snabe later said Maersk rebuilt its network of 4,000 servers and 45,000 PCs in 10 days, at an estimated cost of $250 million to $300 million. The recovery plan, in the end, was a power outage in West Africa.
The five layers of recovery
1. Copies: from 3-2-1 to 3-2-1-1-0
CISA’s Data Backup Options paper describes the 3-2-1 rule: three copies (one primary and two backups), on two different media types, with one copy offsite. Veeam says it extended the rule to 3-2-1-1-0, adding one immutable copy and zero recovery errors.
2. Immutability
An immutable backup can’t be changed or deleted for a set period. In the compliance mode of Amazon S3 Object Lock, for example, a protected object version can’t be overwritten or deleted by any user, including the account’s root user; governance mode lets users with special permissions override it. A backup an administrator can delete is one an attacker with that administrator’s password can delete.
3. Separation, or the air gap
CISA’s #StopRansomware Guide recommends offline, encrypted backups and warns that many ransomware variants try to find and delete or encrypt accessible backups. Separation can be physical or logical: separate credentials, identity and network paths for the backup control plane. The test: if a domain administrator is phished, is there any path from that credential to the backups?
4. Clean-room recovery
Restoring into a compromised network risks restoring the intruder too. The CISA guide says to restore critical systems on a clean network, in an order set by a predefined critical asset list, and to keep “golden images” of critical systems current.
5. Testing and orchestration
CISA also calls for regularly testing the availability and integrity of backups in a disaster recovery scenario. A recovery time is real only once it has been measured: which systems come back first, in what order, verified how.
The numbers, with dates
| Figure | What it measures | Source |
|---|---|---|
| 3 weeks | Average time to recover, down from five weeks in the 2024 report | Sophos, State of Ransomware 2026 |
| 55% | Organizations that recovered within one week | Sophos, State of Ransomware 2026 |
| $1.7 million | Mean recovery cost excluding any ransom ($1,700,200); median $375,000 | Sophos, State of Ransomware 2026 |
| 66% | Attacks with encrypted data where backups were used to recover | Sophos, State of Ransomware 2026 |
| 2x | Recovery costs when the ransom was paid ($750,000) versus restored from backups ($375,000) | Sophos, State of Ransomware 2023 |
| 8x | Median recovery cost with compromised backups ($3 million) versus intact ($375,000) | Sophos, March 2024 |
| 96%, then 89% | Backup repositories targeted: in 96% of attacks (2024 report), at 89% of organizations (2025 report) | Veeam 2024, Veeam 2025 |
Four ways backups fail
- The restore was never tested at scale. Divide the data that must come back by measured restore throughput: 60 TB at a sustained 1 GB per second takes about 17 hours, and at 100 MB per second, close to a week.
- Backups shared credentials with production. If one stolen admin login reaches both, a single credential can take out production and the backups together.
- The SaaS gap. Microsoft’s shared responsibility model says that in every cloud deployment type, the customer owns its data and identities and is responsible for protecting them.
- Insurance was mistaken for a recovery plan. A policy restores nothing, and insurers can ask about these controls before they write cover: Chubb’s cyber proposal form asks about immutable (WORM) and air-gapped backups and whether full restore tests run at least annually.
What to ask of a recovery platform
Neither the episode nor this brief ranks vendors. Those working on this problem include, among them, Cohesity, Commvault, Druva, Rubrik and Veeam (listed alphabetically), and the right choice depends on the environment. Ask each shortlisted platform to demonstrate immutability on by default, anomaly detection that spots mass encryption in backup data, instant restore from backup storage, SaaS coverage alongside data center and cloud workloads, and recovery orchestration that can be rehearsed on a schedule.
Five questions for your team
- What exactly is immutable today, and for how long?
- When was the last large restore, and how long did it take?
- Could someone holding stolen admin credentials delete the backups?
- Who backs up the organization’s SaaS data, and has anyone confirmed it?
- If production is compromised, where do systems get restored to?
What to do next
- List every backup copy, marking which are immutable or offline and for how long.
- Move backup administration to separate credentials and identity.
- Time a restore of a large, representative system and compare it with the recovery time objective.
- Write the restore order from a critical asset list and prepare an isolated environment to restore into.
- Confirm in writing who protects Microsoft 365, Google Workspace and Salesforce data.
- Check current controls against the backup questions on the cyber insurance application.
Go deeper
- Ransomware recovery plan: a runbook built on CISA and NIST
- The 3-2-1-1-0 backup rule: how to implement it
- Backup restore testing: how often and what to test
- Air-gapped backup: physical vs logical vs immutable
- Immutable backup storage compared
Sources
- Cyber Monitoring Centre, Statement on the Jaguar Land Rover Cyber Incident, October 22, 2025
- WIRED, The Untold Story of NotPetya, August 22, 2018
- Veeam, Ransomware Encryption: Prevention and Response, July 15, 2024
- Veeam, From Reactive to Proactive, November 10, 2025
- Veeam, What is the 3-2-1 Backup Rule?, February 5, 2024
- Sophos, The State of Ransomware 2026, 2026
- Sophos, State of Ransomware 2023 press release, May 10, 2023
- Sophos, The Impact of Compromised Backups on Ransomware Outcomes, March 2024
- CISA, Data Backup Options, 2012
- CISA, #StopRansomware Guide, September 2023
- Amazon Web Services, Locking objects with Object Lock, undated
- Microsoft Learn, Shared responsibility in the cloud, updated August 24, 2026
- Chubb, Cyber Enterprise Risk Management Extensive Proposal Form, undated
Frequently asked questions
What is the 3-2-1-1-0 backup rule?
It adds two digits to the 3-2-1 rule of three copies, two media types and one offsite copy: one immutable copy and zero recovery errors. Veeam describes the extension as its own.
How long does ransomware recovery take?
In Sophos’s State of Ransomware 2026, the average was three weeks, and 55% of organizations recovered within one week. Maersk rebuilt its core network in 10 days after NotPetya, though WIRED reports that rebuilding its software setup took close to two months.
Does paying the ransom get the data back?
Not reliably. Veeam’s 2024 report found that one in three organizations that paid could not recover their data, and Sophos’s 2023 report found that paying doubled recovery costs compared with restoring from backups.
Is an immutable backup the same as an air-gapped backup?
They solve different problems. Immutability stops a backup from being changed or deleted for a set period; an air gap separates the backup’s credentials, identity and network paths from production. The two can be combined.
Last checked: October 2026.