When the backup gets encrypted too: the three design flaws behind almost every data loss

"Everything is gone. Including the backup." — That's how the call no managing director ever wants to make begins, typically on a Friday afternoon. And in almost all of these cases, the real cause is not the ransomware but design flaws in the backup concept made years earlier. Three of them show up in initial analyses again and again.

The rule behind it — short and without mysticism

Today's gold standard is the 3-2-1-1-0 rule: 3 copies of your data (the original plus two backups) · 2 different media (not both on the same NAS, not both with the same cloud provider) · 1 copy off-site (geographically separated) · 1 immutable copy (unchangeable — even for admins) · 0 errors in tested restores. Sounds trivial — and is constantly violated anyway. Here are the three typical design flaws.

Flaw 1: The backup sits in the same network as the servers

The classic behind "the backup is encrypted too": the backup server sits in the same network as production, reachable with the same domain admin that has access everywhere. Once ransomware is in, it calmly works its way to the backup server — and encrypts there as well.

What prevents it: immutable backups — once written, unchangeable for a defined period, even by admins. Separate backup accounts with their own credentials, outside the normal domain. An external copy with object lock that the malware can't even reach. That's why every serious managed backup concept includes at least one immutable copy — non-negotiable.

Flaw 2: "The backup runs" is no proof that "the backup works"

A green backup log for two years says nothing about whether restoration will succeed in an emergency — it then often fails on a trivial configuration error nobody noticed, because nobody ever actually restored anything. Experience shows a frightening share of first restore attempts fail.

What prevents it: regular real restores — at least quarterly, actually bring back a file or a VM instead of ticking off a test run. Automatic restore validation by the backup software. A documented recovery plan that, when in doubt, a colleague other than the backup admin can execute.

Flaw 3: Microsoft 365 is not backed up

The flaw almost nobody knows about: Microsoft does not back up your M365 data for you. Responsibility for emails, Teams chats, SharePoint content and OneDrive data lies with the customer — Microsoft's own recovery windows are tightly limited. A typical scenario: a departing employee empties their mailbox, and weeks later years of contract correspondence are missing — without a separate M365 backup, that loss is irreparable.

What prevents it: a dedicated cloud-to-cloud backup for M365 in EU data centers, plus retention periods that match your industry (for fiduciaries and tax advisors, e.g. at least 10 years).

What a serious managed backup actually includes

Backup of servers, virtual machines and Microsoft 365 · at least one immutable copy — on request on dedicated server resources in the certified KÜS-DATA data center in the Greater Region (DIN EN 50600, ISO 27001) · end-to-end encryption (AES-256) with keys held by the customer · documented restore tests · 24/7 monitoring with escalation if a backup run fails · a quarterly report with status, tested restores and recommendations. The model is always the same: a predictable monthly fee, no emergency surcharges.

The question is not if, but when

With backups there is no middle ground between "it runs" and "it saves us". The free backup quick check: 30 minutes on the phone measuring your current strategy against exactly these three flaws. — 📞 +352 20 60 12 44 · 📧 mail@local-it-partner.lu