Ransomware-Proof Your Backups: The Case for Immutable Storage

Here’s what changed about ransomware: attackers aren’t just after your files anymore — they’re after your backups. They know a clean backup is the one thing that lets you say “no” to the ransom. In Veeam’s 2025 research, 89% of organizations hit had their backup repositories targeted. Your safety net is now the bullseye.

The uncomfortable numbers

From that same research: only 10% of attacked organizations recovered more than 90% of their data, and more than half — 57% — got back less than half of it. Confidence offered no protection either: 69% believed they were ready before the attack, and that confidence dropped by more than 20 points afterward. The dangerous gap is between “we have backups” and “we can actually recover.”

What “immutable” actually means

An immutable backup is a copy that cannot be changed, deleted, or encrypted for a set period — not by an attacker, not by a rogue admin, not by accident. Think of it as a safe with a time lock: once the data goes in, the door won’t open until the clock says so. Even if ransomware gets full run of your network, it can’t touch what it can’t rewrite.

The rule that replaced 3-2-1: meet 3-2-1-1-0

The classic backup rule was 3-2-1: three copies, two media types, one offsite. Ransomware forced an upgrade. Veeam now recommends 3-2-1-1-0:

• 3 copies of your data
• 2 different media types
• 1 copy offsite
• 1 copy immutable or air-gapped
• 0 recovery errors — verified by actually testing your restores

That extra “1” is the immutable copy that survives an attack. The “0” is the discipline that proves it will work.

How it’s done in the real world

Immutability isn’t exotic anymore. Cloud object storage like Amazon S3 offers Object Lock, which enforces write-once-read-many so backups can’t be deleted before their time. On-premises, hardened immutable repositories and air-gapped copies do the same job. The right mix depends on your environment — but the principle is universal: at least one copy an attacker simply can’t reach.