Cybersecurity
Ransomware groups target backup systems
A sponsored Kaseya article said ransomware groups had been trying to disable backup systems before encrypting data, and argued that isolation, immutable storage and restore testing were now required.
- The article said ransomware operators had been wiping recovery points and disrupting restoration systems to increase pressure on victims to pay.
- It said ALPHV/BlackCat encrypted Change Healthcare’s systems in February 2024, UnitedHealth paid $22 million, and estimated recovery costs reached $1.6 billion.
- It said BlackMatter used compromised administrator credentials in 2021 to find and erase backups at NEW Cooperative and Crystal Valley, and that CISA, the FBI and the NSA had documented the tactic.
- It said a joint CISA and FBI advisory in August 2026 described Gunra deleting backup and archive data at both a primary data centre and a disaster recovery site.
- The article was sponsored and written by Kaseya, which urged isolated backups, immutable storage, tighter access controls and regular restore testing.
The article said ransomware operators had been targeting backups so they could remove recovery options and increase pressure to pay. It argued that a backup only worked if attackers could not reach it.
It cited February 2024 as the date ALPHV/BlackCat encrypted Change Healthcare’s systems after entering a remote access portal without multi-factor authentication. The article said UnitedHealth paid $22 million and still did not recover the data, while recovery costs were estimated at $1.6 billion.
The piece then described BlackMatter attacks on NEW Cooperative and Crystal Valley in 2021, saying the group used compromised administrator credentials to find and erase backup stores before encrypting other systems. It said CISA, the FBI and the NSA had jointly documented that approach, and that a joint CISA and FBI advisory in August 2026 described Gunra deleting backup and archive data at both a primary data centre and a disaster recovery site.
Kaseya said organisations should separate backups from production, use immutable storage, limit administrative access and test restores regularly. It also cited IBM figures on ransomware costs and said almost 77% of IT organisations and 65% of MSPs reported that security spending was not keeping pace.
Named in this story
Companies
- Kaseya
- sponsored and wrote the article
- Change Healthcare
- had its systems encrypted in February 2024
- UnitedHealth
- paid ransom after the Change Healthcare attack
- IBM
- provided the breach-cost research cited in the article
Organisations
- ALPHV/BlackCat ransomware group
- encrypted Change Healthcare’s systems in February 2024
- BlackMatter ransomware
- destroyed backups at farm businesses in 2021
- NEW Cooperative
- had backup data stores and appliances wiped in 2021
- Crystal Valley
- had backup data stores and appliances wiped in 2021
Governments and agencies
- CISA
- jointly documented the backup-destruction tactic and issued an advisory
- FBI
- jointly documented the backup-destruction tactic and issued an advisory
- NSA
- jointly documented the backup-destruction tactic
Products and systems
- Gunra ransomware
- was described in an August 2026 advisory as deleting backups and archives
Places
- Iowa
- was the home state of NEW Cooperative
- Minnesota
- was the home state of Crystal Valley
How the source tells it
The piece was cautionary and promotional, using urgent language to press Kaseya’s backup-security message.
- alarm Catastrophic losses and lost recovery options were used to heighten concern about backup compromise.
- urgency Imperative advice and repeated calls to act framed backup protection as immediate and necessary.
- vendor boosterism Sponsored branding and a report download push folded Kaseya’s own product messaging into the article.