Ransomware attacks rise as backup recovery worsens

A study by Omdia and Object First found that successful ransomware attacks are becoming more common and recovery rates are worsening. It also identified a wide gap between the number of technology leaders who view immutable backup storage as essential and those who say they have it.

Among organisations surveyed, 83% suffered a successful ransomware attack in the previous 24 months, up from 66% in the prior year's study. Of those hit, only 39% said they recovered at least 75% of their data after an attack, down from 57% a year earlier.

The figures suggest growing difficulty not only in preventing attacks but also in restoring systems and data after an incident. Three-quarters of respondents that experienced a successful attack also reported multiple service interruptions.

Recovery times also worsened. Just 39% of respondents said they maintained a Recovery Time Objective of five days or less, down from 49% in the earlier survey, while 64% reported an outage that exceeded their Recovery Time Objective targets.

Data loss also appears to be straining existing continuity plans. The study found that 76% said their largest data loss event exceeded their Recovery Point Objective targets.

Immutability gap

A central finding was what the study described as an immutability gap in backup storage environments. While 93% of technology leaders surveyed said absolute immutability was a critical requirement for backup storage, only 16% said their current environment met that standard.

Omdia defined absolute immutability as a state in which no one can modify or delete backup data, including highly privileged administrators or attackers with access to an organisation's IT credentials and secrets. The distinction matters because many companies appear to believe they have stronger backup protections than their systems actually provide.

The survey suggests backup storage is increasingly seen as the final safeguard when perimeter defences fail. It found that 83% of respondents viewed backup storage as the last line of defence against ransomware, while 73% of line-of-business leaders and C-suite executives said backups with absolute immutability were required for an effective business resilience strategy.

The findings also point to growing scepticism toward supplier marketing and technical claims. Nearly nine in 10 respondents, or 89%, said vendor claims of immutability required third-party validation before they could be trusted.

Survey scope

Omdia surveyed 700 respondents across the US, UK, Ireland, France and the DACH region. The research covered organisations with 1,000 to 9,999 employees and included 500 IT decision-makers involved in cybersecurity, data centre infrastructure, and business continuity and disaster recovery purchasing, alongside 200 line-of-business leaders at director level and above who were familiar with their organisations' policies in those areas.

Including both technical buyers and senior business managers gives the findings a broader organisational lens than many cyber surveys, which often focus only on IT teams. It also suggests that concerns about ransomware resilience have spread beyond security departments into operational and executive ranks.

Simon Robinson, principal analyst at Omdia, said the results showed that many organisations still lacked dependable recovery measures.

"Ransomware can lead to a business continuity crisis, and the data shows that many organizations fall short when it comes to reliable recovery," Robinson said. "While most technology leaders recognize the importance of immutable backups, the research points to a clear gap between perceived immutability and Absolute Immutability. Closing that gap is essential for organizations that need confidence their backup data will remain recoverable when attacks occur."

For backup vendors and buyers, the report highlights a shift in emphasis from prevention alone to proof of recoverability under attack conditions. As ransomware incidents continue to disrupt operations, the ability to demonstrate that backup data cannot be altered or deleted is becoming a more closely examined factor in procurement and resilience planning.

David Bennett, chief executive officer at Object First, said recovery plans could not rely on backups that remained vulnerable after a breach.

"When ransomware strikes, recovery can't depend on backups that can still be altered, deleted, or compromised," Bennett said. "Omdia's research reinforces what we hear from our customers every day: absolutely immutable backup storage is the last line of defense against ransomware. Organisations need confidence that even if attackers gain access to IT credentials or compromise production systems, their backup data remains protected and recoverable."