Ransomware encrypted their backups too — because they were mounted

Ransomware encrypted their backups too — because they were mounted

Agency, 2TB of client work. They had a real backup server. Problem: it was a permanently mounted network drive, writable from every workstation. The ransomware walked the drive letter and encrypted the backups alongside the originals in the same pass.

Paid the ransom: 1.4 BTC (~$38,000 at the time). Got 60% of files back.

A backup your live machine can write to is a backup ransomware can destroy. Offline or air-gapped, or it's theater. Fight me.