{"id":85718,"date":"2026-08-28T08:21:57","date_gmt":"2026-08-28T15:21:57","guid":{"rendered":"https:\/\/drivesaversdatarecovery.com\/?p=85718"},"modified":"2026-08-28T13:29:24","modified_gmt":"2026-08-28T20:29:24","slug":"why-immutable-backups-can-still-be-compromised","status":"publish","type":"post","link":"https:\/\/drivesaversdatarecovery.com\/en-au\/blog\/why-immutable-backups-can-still-be-compromised\/","title":{"rendered":"Why Immutable Backups Can Still Be Compromised"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><div id=\"case-study-image-and-title\" class=\"vc_section blog-header-top-padding vc_custom_1743006484198 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t  <style>\n\n.vcex-video.wpex-bg-black {\n  border-radius: 15px;\n  overflow: hidden;\n}\n\n.vcex-video-inner video {\n  border-radius: 15px;\n}\n\n.case-study-video {\nborder-radius: 15px !important;\n}\n\n.cs-red-heading {\n      color: #EC0912;\nfont-weight: 600;\n    }\n.vcex-heading-inner {\nmargin-bottom:12px;\n}\n        .single-post-title {\n            display: none;\n        }\n    ul.meta {\n       display:none;\n        }\n\n.parent-div {\n  display: flex !important;       \/* Lay the items out in a row by default (desktop) *\/\n  flex-wrap: nowrap !important;   \/* Prevent wrapping on large screens *\/\n}\n\n\/* When the screen is below, say, 768px, wrap and make each child 50% width *\/\n@media (max-width: 768px) {\n  .parent-div {\n    flex-wrap: wrap !important;   \/* Allow wrapping on smaller screens (mobile) *\/\nfont-size: 15px !important;\n  }\n  .parent-div > div {\n    width: 50% !important;        \/* 2 columns (two items per row) *\/\n    box-sizing: border-box !important; \n  }\n.cs-quote-headshot {text-align: center;margin-bottom:13px;}\n.cs-quote-box {\n    margin-left: 30px;\n    margin-right: 30px;\n\n}\n.cs-quote-headshot-image {\nmax-width: 170px;\nmargin-bottom:13px;\nmargin: auto;\n}\n.cs-quote-nametitle {\ntext-align: center !important;\nalign-items: center !important;\n}\n\n}\n\n.cs-main-image-header .wpex-p-30 {\n    padding: 0 !important;\n    padding-left: 3% !important;\npadding-bottom: 3% !important;\n}\n\n.cs-main-image-header .wpex-items-center {\n    align-items: end !important;\n}\n\n@media screen and (max-width: 1300px) {\n    .cs-main-image-header .vcex-ib-content .vcex-ib-title {\n        font-size: 3.5vw !important;\n    }\n\n    .cs-main-image-header .vcex-ib-content .vcex-ib-caption {\n        font-size: 5.5vw !important;\n    }\n}\n\n.cs-main-image-header .vcex-ib-content {\n text-shadow: 0 0 10px #000; \n}\n\n.vc_custom_1743006484198 {\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n\n.case-study-image-and-title\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n.blog-header-top-padding\n\n{\n    margin-top: -10px !important;\n    padding-bottom: 4% !important;\n    background-color: #000000 !important;\n}\n  <\/style>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1764869151897 wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><style>.vcex-image-banner.vcex_6a925ea78d304 .vcex-ib-title{color:#fefefe;font-size:57px;font-family:'DM Sans', sans-serif;font-weight:600;}.vcex-image-banner.vcex_6a925ea78d304 .vcex-ib-caption{color:#ffffff;font-size:45px;font-family:'DM Sans', sans-serif;font-weight:600;}<\/style><div class=\"vcex-module vcex-image-banner wpex-flex wpex-flex-col wpex-w-100 wpex-justify-center wpex-relative wpex-overflow-hidden wpex-bg-gray-900 wpex-text-white wpex-hover-text-white wpex-text-left wpex-rounded-md vcex-has-img-tag cs-main-image-header vcex_6a925ea78d304\"><img  src=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/08\/Why-Immutable-Backups-Can-Still-Be-Compromised-2-1.png\" class=\"vcex-ib-img wpex-block wpex-transition-all wpex-duration-500\" alt=\"\"><div class=\"vcex-ib-content-wrap wpex-w-100 wpex-transition-all wpex-duration-500 wpex-absolute wpex-inset-0 wpex-flex wpex-items-center wpex-p-30\"><div class=\"vcex-ib-content wpex-flex-grow wpex-mr-auto\"><h3 class=\"vcex-ib-title wpex-heading translation-block\">Why Immutable Backups<br>\r\nCan Still Be Compromised<\/h3><\/div><\/div><\/div><div class=\"vcex-spacing wpex-w-100 wpex-clear\" style=\"height:35px;\"><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#ffffff;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Backups are frequently compromised in ransomware attacks. In some cases DriveSavers has handled, the affected backup solution was marketed as immutable.<\/p>\n<p>Immutable backups are a standard defense against ransomware, often paired with air-gapping those backups. But immutability does not guarantee that data will be recoverable after an attack.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-blurb-and-scenario\" class=\"vc_section vc_custom_1772461320762 wpex-relative\"><div class=\"vc_row wpb_row vc_row-fluid wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><style>.vcex-heading.vcex_6a925ea78edc3{color:#e31f26;}.vcex-heading.vcex_6a925ea78edc3 .vcex-heading-icon{color:#e31f26;}<\/style><h4 class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-h4 wpex-text-left vcex_6a925ea78edc3\"><span class=\"vcex-heading-inner wpex-inline-block\"><span class=\"vcex-heading-icon vcex-heading-icon-left vcex-icon-wrap wpex-mr-10\"><span aria-hidden=\"true\" class=\"fa fa-solid fa-circle-info\"><\/span><\/span>What Is an Immutable Backup?<\/span><\/h4>\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>An immutable backup is a copy of data that can&#8217;t be changed or deleted for a set retention period, even by an administrator. That write-once design makes immutability a standard defense against ransomware, since, in theory, attackers can&#8217;t tamper with a backup they can&#8217;t modify. But immutability protects only the data, not the software and credentials that manage it.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div id=\"video\" class=\"vc_row wpb_row vc_row-fluid vc_custom_1787935386791 vc_row-o-content-middle vc_row-flex wpex-relative wpex-vc_row-has-fill no-bottom-margins wpex-vc-reset-negative-margin\" style=\"border-color:#000000!important;\"><div class=\"wpb_column vc_column_container vc_col-sm-12\" id=\"video\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><style>.vcex-heading.vcex_6a925ea78fc42{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6a925ea78fc42{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6a925ea78fc42{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6a925ea78fc42{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6a925ea78fc42{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6a925ea78fc42 translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">Customer <strong><span style=\"color: #e31f26\">Case Study<\/span><\/strong><\/span><\/div>\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>In October 2025, Akira ransomware reached a customer&#8217;s Nakivo backup repository, a platform marketed on its immutable storage. The Nakivo backups were deleted, while virtual machine data on the volume was encrypted.<\/p>\n<p>The customer&#8217;s IT team ran recovery utilities against the volume for several days without success. They also copied 15TB of production data onto the same storage the deleted backups had occupied. That process overwrote portions of the deleted backup data.<\/p>\n<p>DriveSavers imaged the drives and manually rebuilt missing BTRFS mapping information to reach backup data the volume had already released. Recovery on the priority database server reached 99.4 percent from the backup repository alone. Merging the unencrypted regions of the production virtual disks with the backup data brought the success rate to 99.91 percent.<\/p>\n<p>Without those 15TB of overwrites, it would have been a complete recovery.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-solution\" class=\"vc_section wpex-relative\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6a925ea790ded{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6a925ea790ded{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6a925ea790ded{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6a925ea790ded{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6a925ea790ded{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6a925ea790ded translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">Immutable, Air-Gapped, and <strong><span style=\"color: #e31f26\">Where Each One Stops<\/span><\/strong><\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Immutability and air gapping get mentioned in the same breath, and they do different jobs.<\/p>\n<p class=\"translation-block\">Veeam draws <a href=\"https:\/\/www.veeam.com\/blog\/air-gap-vs-immutable-backups-key-differences.html\" target=\"_blank\" rel=\"noopener\">the distinction<\/a> clearly. An air-gapped backup is isolated from the network, either physically by removing the drive or disconnecting the ports, or digitally by blocking network traffic to it. An immutable backup cannot be changed or deleted until its retention period expires, but immutability does not require it to be offline. It may remain reachable over the network.<\/p>\n<p>Veeam names the weakness of each. Physical logistics slow recovery from an air gap. Immutable backups remain accessible over the network, posing a risk when the controls around them are weak.<\/p>\n<p>Immutability stops a backup from being altered. An air gap stops it from being reached. A compromised management layer cannot affect a backup it cannot reach.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6a925ea79220b{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6a925ea79220b{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6a925ea79220b{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6a925ea79220b{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6a925ea79220b{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6a925ea79220b translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">What to <strong><span style=\"color: #e31f26\">Check Now<\/span><\/strong><\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Ask your vendor one question: can an administrator with full privileges override the immutability setting on this platform?<\/p>\n<p>The answer will depend on how immutability is implemented. On some systems, users with sufficient privileges can override the protection; on others, no user can remove it until the retention period expires.<\/p>\n<p>Then ask where the write-once protection is enforced. Immutability implemented by the backup application depends on that application staying trustworthy. Immutability enforced at the storage layer, through object lock on S3-compatible storage or a hardware appliance with WORM protection, does not depend solely on the backup application to enforce it.<\/p>\n<p>Once you understand how your immutable backups are protected, take steps to protect the infrastructure around them:<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1777731664853 vc_row-o-equal-height vc_row-flex wpex-relative wpex-vc-has-custom-column-spacing wpex-vc-column-spacing-0px no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-3 wpex-vc_col-has-fill\"><div style=\"border-color:#000000!important;\" class=\"vc_column-inner vc_custom_1777731447846\"><div class=\"wpb_wrapper\"><style>.vcex-heading.vcex_6a925ea793677{color:#e31f26;}<\/style><h4 class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-h4 wpex-text-center vcex_6a925ea793677\"><span class=\"vcex-heading-inner wpex-inline-block\">Harden the management layer<\/span><\/h4><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div>\n\t<div style=\"color:#6f737e;text-align:center;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Keep the backup console on separate credentials rather than the production directory, so compromising the domain does not hand over the backups with it. Require multi-factor authentication on the console.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-3 wpex-vc_col-has-fill\"><div style=\"border-color:#000000!important;\" class=\"vc_column-inner vc_custom_1787855815151\"><div class=\"wpb_wrapper\"><style>.vcex-heading.vcex_6a925ea794203{color:#e31f26;}<\/style><h4 class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-h4 wpex-text-center vcex_6a925ea794203\"><span class=\"vcex-heading-inner wpex-inline-block\">Limit administrative access<\/span><\/h4><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div>\n\t<div style=\"color:#6f737e;letter-spacing:var(--wpex-tracking-normal);text-align:center;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Restrict the number of accounts with full privileges and review that access regularly.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-3 wpex-vc_col-has-fill\"><div style=\"background-color:#ffffff!important;border-color:#000000!important;\" class=\"vc_column-inner vc_custom_1777731463422\"><div class=\"wpb_wrapper\"><style>.vcex-heading.vcex_6a925ea794d57{color:#e31f26;}<\/style><h4 class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-h4 wpex-text-center vcex_6a925ea794d57\"><span class=\"vcex-heading-inner wpex-inline-block\">Re-test after administrative changes<\/span><\/h4><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div>\n\t<div style=\"color:#6f737e;text-align:center;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Verify the immutability policy whenever a backup administrator changes rather than assuming the inherited configuration is still working as intended.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><div class=\"wpb_column vc_column_container vc_col-sm-3 wpex-vc_col-has-fill\"><div style=\"border-color:#000000!important;\" class=\"vc_column-inner vc_custom_1777731472225\"><div class=\"wpb_wrapper\"><style>.vcex-heading.vcex_6a925ea7958fa{color:#e31f26;}<\/style><h4 class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-h4 wpex-text-center vcex_6a925ea7958fa\"><span class=\"vcex-heading-inner wpex-inline-block\">Test the backup infrastructure as a target<\/span><\/h4><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div>\n\t<div style=\"color:#6f737e;text-align:center;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Attackers target recovery capability. Include backup infrastructure in penetration testing rather than treating it as outside the attack surface.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div id=\"case-study-results\" class=\"vc_section vc_custom_1772464064344 wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6a925ea796b42{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6a925ea796b42{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6a925ea796b42{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6a925ea796b42{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6a925ea796b42{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6a925ea796b42 translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">What Is <strong><span style=\"color: #e31f26\">Actually Recoverable<\/span><\/strong><\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p class=\"translation-block\">Based on their survey of more than 900 senior IT, security, and risk leaders, Veeam\u2019s <a href=\"https:\/\/www.veeam.com\/company\/press-release\/veeam-report-reveals-a-market-wide-shift-from-recovery-confidence-to-proven-data-resilience-amid-ransomware-threats-and-ai-adoption.html\" target=\"_blank\" rel=\"noopener\">Data Trust and Resilience Report 2026<\/a> found that 90 percent of organizations were confident they could recover from a cyber incident. Among respondents who had actually experienced a ransomware incident, only 28% fully recovered all affected data. 44% recovered less than three-quarters of it, leaving significant gaps.<\/p>\n<p>Deleted or encrypted is not the same as not recoverable. When DriveSavers takes on a ransomware data recovery job, the work starts by identifying what remains on the media and what can be rebuilt from it.<\/p>\n<p>Our engineers repair the structural damage encryption causes to virtual disks, backup files, and databases. When a decryptor has already run and left files corrupt, we may be able to repair the resulting damage. When a virtual disk is partially encrypted, DriveSavers uses its tools and techniques to identify and recover data from unaffected areas. We also recover older or unaffected versions of the data, including from copy-on-write systems, and we search alternative sources such as tape and cloud assets.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div class=\"vc_section vc_custom_1772464080847 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6a925ea7981f2{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6a925ea7981f2{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6a925ea7981f2{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6a925ea7981f2{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6a925ea7981f2{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6a925ea7981f2 translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\"><strong><span style=\"color: #e31f26\">Protecting<\/span><\/strong> Your Recovery Options\r\n<\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Disconnect affected devices from the network as soon as you can. Disconnect external storage and prevent affected systems from accessing connected cloud storage.<\/p>\n<p>Disconnecting is not the same as shutting down. Powering a machine down can erase evidence held in volatile memory, so treat it as a last resort when disconnection is not possible.<\/p>\n<p>Most importantly, do not write new data to storage containing deleted or damaged backups. Restoring data or continuing to use the affected storage can overwrite data that may otherwise be recoverable.<\/p>\n<p>Turn off shared network resources and disable remote access to the infected devices. Keep the ransom note and any suspicious emails or attachments. Then call before anything is restored or rebuilt.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6a925ea79961c{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6a925ea79961c{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6a925ea79961c{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6a925ea79961c{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6a925ea79961c{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6a925ea79961c translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">When the Decryptor Is <strong><span style=\"color: #e31f26\">Not 100% Successful<\/span><\/strong><\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Paying the ransom demand does not close the gap either. In Veeam&#8217;s 2025 research, 17 percent of organizations reported they could not retrieve their data, despite meeting the attacker&#8217;s demands.<\/p>\n<p>Decryptors can fail on large files, such as databases and backup files. Incomplete encryption can also cause a decryptor to fail. If an attack is interrupted during encryption, a file may be altered without reaching the complete encrypted state the decryptor expects, leaving the decryptor unable to restore it.<\/p>\n<p>DriveSavers frequently works with clients who have obtained a decryptor but still need data recovery because the decryptor has failed to restore their data or has left files corrupted.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div id=\"case-study-takeaways\" class=\"vc_section vc_custom_1772464095377 vc_section-o-content-middle vc_section-flex wpex-vc-full-width-section wpex-vc-full-width-section--centered wpex-relative wpex-vc_section-has-fill wpex-vc-reset-negative-margin\"><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 40px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><style>.vcex-heading.vcex_6a925ea79ac52{color:#3e3d3e;font-size:35px;font-weight:400;}@media (max-width:1024px){.vcex-heading.vcex_6a925ea79ac52{font-size:25px;}}@media (max-width:959px){.vcex-heading.vcex_6a925ea79ac52{font-size:25px;}}@media (max-width:767px){.vcex-heading.vcex_6a925ea79ac52{font-size:25px;}}@media (max-width:479px){.vcex-heading.vcex_6a925ea79ac52{font-size:25px;}}<\/style><div class=\"vcex-heading vcex-heading-plain vcex-module wpex-heading wpex-text-2xl wpex-div vcex_6a925ea79ac52 translation-block\"><span class=\"vcex-heading-inner wpex-inline-block\">Put Ransomware Data Recovery Services <strong><span style=\"color: #e31f26\">in the Plan<\/span><\/strong><\/span><\/div><div class=\"vc_empty_space\"   style=\"height: 10px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;font-size:18px;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Deterrence and prevention get most of the attention, and they should. But Incident Response guidance often treats ransomware data recovery services as a last resort, discovered mid-crisis rather than planned for in advance.<\/p>\n<p>The wrong time for an organization to start planning solutions is after the backups have already been targeted, and standard recovery methods have failed. Time is critical in a ransomware response: determining whether data is recoverable can take hours or days, while decisions about business continuity and ransom negotiations may need to be made much sooner.<\/p>\n<p>Whoever is making the calls is doing so under pressure, and there should already be a trusted data recovery provider in the response plan. We are seeing cyber insurers ask whether the data is recoverable before they will negotiate a ransom payment, so naming a provider in advance can fast-track the whole recovery.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 70px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_custom_1776873720672 wpex-relative wpex-vc_row-has-fill no-bottom-margins wpex-vc-reset-negative-margin\" style=\"border-color:#000000!important;\"><div class=\"wpb_column vc_column_container vc_col-sm-12 wpex-vc_col-has-fill\"><div class=\"vc_column-inner vc_custom_1760029818507\"><div class=\"wpb_wrapper\">\n\t<div style=\"color:#6f737e;\" class=\"wpb_text_column has-custom-color wpex-child-inherit-color wpb_content_element vc_custom_1787857055412\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p style=\"text-align: center;\" class=\"translation-block\"><strong>If your organization needs help assessing whether data recovery is possible after an attack, we offer professional <a href=\"https:\/\/drivesaversdatarecovery.com\/en-au\/ransomware-data-recovery\/\" target=\"_self\">ransomware data recovery services<\/a> trusted by insurers and incident response firms.<br>\r\n<a href=\"\/en-au\/contact-drivesavers-b2b\/\" target=\"_self\">Contact DriveSavers<\/a> at <a href=\"tel:+18882822227\" target=\"_self\">1 (888) 282-2227<\/a>.<br>\r\n<\/strong><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid vc_row-o-content-middle vc_row-flex wpex-relative no-bottom-margins\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"vc_empty_space\"   style=\"height: 30px\"><span class=\"vc_empty_space_inner\"><\/span><\/div><\/div><\/div><\/div><\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Why immutable backups can still be compromised, when a decryptor won&#8217;t save you, and where ransomware data recovery fits.<\/p>","protected":false},"author":53,"featured_media":85747,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"inline_featured_image":false,"footnotes":""},"categories":[264],"tags":[],"post_series":[],"class_list":["post-85718","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","entry","has-media"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.2 (Yoast SEO v28.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Immutable Backups and Ransomware Data Recovery | DriveSavers<\/title>\n<meta name=\"description\" content=\"Why immutable backups can still be compromised, when a decryptor won&#039;t save you, and where ransomware data recovery fits.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/drivesaversdatarecovery.com\/en-au\/blog\/why-immutable-backups-can-still-be-compromised\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why Immutable Backups Can Still Be Compromised\" \/>\n<meta property=\"og:description\" content=\"Why immutable backups can still be compromised, when a decryptor won&#039;t save you, and where ransomware data recovery fits.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/drivesaversdatarecovery.com\/en-au\/blog\/why-immutable-backups-can-still-be-compromised\/\" \/>\n<meta property=\"og:site_name\" content=\"DriveSavers Data Recovery Services\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DriveSavers\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-28T15:21:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-28T20:29:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/08\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Andy Maus\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:site\" content=\"@drivesavers\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andy Maus\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/\"},\"author\":{\"name\":\"Andy Maus\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\"},\"headline\":\"Why Immutable Backups Can Still Be Compromised\",\"datePublished\":\"2026-08-28T15:21:57+00:00\",\"dateModified\":\"2026-08-28T20:29:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/\"},\"wordCount\":3024,\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-AU\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/\",\"name\":\"Immutable Backups and Ransomware Data Recovery | DriveSavers\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png\",\"datePublished\":\"2026-08-28T15:21:57+00:00\",\"dateModified\":\"2026-08-28T20:29:24+00:00\",\"description\":\"Why immutable backups can still be compromised, when a decryptor won't save you, and where ransomware data recovery fits.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/#breadcrumb\"},\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/#primaryimage\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png\",\"width\":1200,\"height\":627},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/blog\\\/why-immutable-backups-can-still-be-compromised\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"DriveSavers\",\"item\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why Immutable Backups Can Still Be Compromised\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#website\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"name\":\"DriveSavers Data Recovery Services\",\"description\":\"The Worldwide Leader in Data Recovery\",\"publisher\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-AU\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#organization\",\"name\":\"DriveSavers Data Recovery\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"contentUrl\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Logo-01.png\",\"width\":1092,\"height\":1087,\"caption\":\"DriveSavers Data Recovery\"},\"image\":{\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DriveSavers\",\"https:\\\/\\\/x.com\\\/drivesavers\",\"https:\\\/\\\/www.instagram.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/drivesavers-data-recovery\\\/\",\"https:\\\/\\\/www.pinterest.com\\\/drivesavers\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCBlynLMdFWQgid-Gwm0zJ1A\",\"https:\\\/\\\/en.wikipedia.org\\\/wiki\\\/DriveSavers\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/#\\\/schema\\\/person\\\/d294f7f00d1aee169b2910510fa7e092\",\"name\":\"Andy Maus\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g\",\"caption\":\"Andy Maus\"},\"description\":\"Andy Maus is Head of Cyber Recovery Services at DriveSavers, leading initiatives that help organizations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.\",\"url\":\"https:\\\/\\\/drivesaversdatarecovery.com\\\/en-au\\\/author\\\/andy-maus\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Immutable Backups and Ransomware Data Recovery | DriveSavers","description":"Why immutable backups can still be compromised, when a decryptor won't save you, and where ransomware data recovery fits.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/drivesaversdatarecovery.com\/en-au\/blog\/why-immutable-backups-can-still-be-compromised\/","og_locale":"en_US","og_type":"article","og_title":"Why Immutable Backups Can Still Be Compromised","og_description":"Why immutable backups can still be compromised, when a decryptor won't save you, and where ransomware data recovery fits.","og_url":"https:\/\/drivesaversdatarecovery.com\/en-au\/blog\/why-immutable-backups-can-still-be-compromised\/","og_site_name":"DriveSavers Data Recovery Services","article_publisher":"https:\/\/www.facebook.com\/DriveSavers","article_published_time":"2026-08-28T15:21:57+00:00","article_modified_time":"2026-08-28T20:29:24+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/08\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png","type":"image\/png"}],"author":"Andy Maus","twitter_card":"summary_large_image","twitter_creator":"@drivesavers","twitter_site":"@drivesavers","twitter_misc":{"Written by":"Andy Maus","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/#article","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/"},"author":{"name":"Andy Maus","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092"},"headline":"Why Immutable Backups Can Still Be Compromised","datePublished":"2026-08-28T15:21:57+00:00","dateModified":"2026-08-28T20:29:24+00:00","mainEntityOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/"},"wordCount":3024,"publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/08\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png","articleSection":["Blog"],"inLanguage":"en-AU"},{"@type":"WebPage","@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/","url":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/","name":"Immutable Backups and Ransomware Data Recovery | DriveSavers","isPartOf":{"@id":"https:\/\/drivesaversdatarecovery.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/#primaryimage"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/#primaryimage"},"thumbnailUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/08\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png","datePublished":"2026-08-28T15:21:57+00:00","dateModified":"2026-08-28T20:29:24+00:00","description":"Why immutable backups can still be compromised, when a decryptor won't save you, and where ransomware data recovery fits.","breadcrumb":{"@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/#breadcrumb"},"inLanguage":"en-AU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/"]}]},{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/#primaryimage","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/08\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2026\/08\/EN-Why-Immutable-Backups-Can-Still-Be-Compromised-3.png","width":1200,"height":627},{"@type":"BreadcrumbList","@id":"https:\/\/drivesaversdatarecovery.com\/blog\/why-immutable-backups-can-still-be-compromised\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"DriveSavers","item":"https:\/\/drivesaversdatarecovery.com\/"},{"@type":"ListItem","position":2,"name":"Why Immutable Backups Can Still Be Compromised"}]},{"@type":"WebSite","@id":"https:\/\/drivesaversdatarecovery.com\/#website","url":"https:\/\/drivesaversdatarecovery.com\/","name":"DriveSavers Data Recovery","description":"The Worldwide Leader in Data Recovery","publisher":{"@id":"https:\/\/drivesaversdatarecovery.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/drivesaversdatarecovery.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-AU"},{"@type":"Organization","@id":"https:\/\/drivesaversdatarecovery.com\/#organization","name":"DriveSavers Data Recovery","url":"https:\/\/drivesaversdatarecovery.com\/","logo":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/","url":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","contentUrl":"https:\/\/drivesaversdatarecovery.com\/wp-content\/uploads\/2021\/08\/Logo-01.png","width":1092,"height":1087,"caption":"DriveSavers Data Recovery"},"image":{"@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DriveSavers","https:\/\/x.com\/drivesavers","https:\/\/www.instagram.com\/drivesavers\/","https:\/\/www.linkedin.com\/company\/drivesavers-data-recovery\/","https:\/\/www.pinterest.com\/drivesavers\/","https:\/\/www.youtube.com\/channel\/UCBlynLMdFWQgid-Gwm0zJ1A","https:\/\/en.wikipedia.org\/wiki\/DriveSavers"]},{"@type":"Person","@id":"https:\/\/drivesaversdatarecovery.com\/#\/schema\/person\/d294f7f00d1aee169b2910510fa7e092","name":"Andy Maus","image":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d40862266d842cfd428c105a72654611de2d431617d5cf0d86aca1087aef2cd0?s=96&d=blank&r=g","caption":"Andy Maus"},"description":"Andy Maus is Head of Cyber Recovery Services at DriveSavers, leading initiatives that help organisations recover critical data following cyber incidents, ransomware attacks, and other security breaches. He joined DriveSavers in 2023 after more than two years at Arete Incident Response, where he introduced Data Recovery Services to the firm\u2019s restoration portfolio, expanded the technical operations team from 10 to over 70 specialists, and built strategic alliances with SentinelOne, Dell, and Presidio. Earlier, at Ontrack Data Recovery, he oversaw global sales, supporting complex data restorations for clients across 22 countries. With more than three decades in the technology industry\u2014including leadership roles at Dell, Mitel, and Level 3 Communications\u2014Andy brings deep experience in cyber incident response, data recovery methodologies, and large-scale technical operations.","url":"https:\/\/drivesaversdatarecovery.com\/en-au\/author\/andy-maus\/"}]}},"_links":{"self":[{"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/posts\/85718","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/users\/53"}],"replies":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/comments?post=85718"}],"version-history":[{"count":10,"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/posts\/85718\/revisions"}],"predecessor-version":[{"id":85753,"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/posts\/85718\/revisions\/85753"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/media\/85747"}],"wp:attachment":[{"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/media?parent=85718"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/categories?post=85718"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/tags?post=85718"},{"taxonomy":"post_series","embeddable":true,"href":"https:\/\/drivesaversdatarecovery.com\/en-au\/wp-json\/wp\/v2\/post_series?post=85718"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}