Backing Up Your Data Is Not Enough Anymore
Monday morning. Someone on your team opens an email, clicks a link, and within hours your files start behaving strangely. You call your IT support and the first question they ask is: when did you last back up? You point to your cloud backup system and feel relieved. Then they tell you the backup has been compromised too. That scenario is no longer rare.
Most practices running cloud backups assume they are covered. The backup is there, it runs automatically, and if something goes wrong you can restore everything. The problem is that modern threats do not work the way older ones did. Ransomware in particular has become patient. It can sit quietly inside your systems for weeks, infecting your backup copies one by one. By the time it activates, every version of your files - including the backups - may already be corrupted. You have a backup, but nothing clean to restore from.
There are other risks too. The company hosting your backups could suffer their own cyberattack, and that breach spreads to their clients. Security settings on cloud storage can be misconfigured, leaving your files exposed to anyone who knows where to look. Even a data centre outage - which does happen - can make your backup temporarily or permanently unavailable at the worst possible moment. Backup without security is just another target.
What good data protection actually looks like is different from what most Canterbury businesses have in place. A proper solution does not just copy your files on a schedule - it monitors those files for threats as they are being backed up, so malware cannot quietly embed itself in your archive. It backs up changes continuously rather than once a day, which matters when losing even a few hours of client records or financial data has real consequences. It uses the same kind of layered access controls you would expect for your banking - different people get access to different things, and everything requires verification. And for businesses handling particularly sensitive information, a second copy kept completely offline adds an extra layer that internet-based attacks simply cannot reach.
If your current backup system was set up more than a couple of years ago, the chances are it was designed for the threats of that time, not now. The right approach is to have someone review what you have - not just whether backups are running, but whether they are actually protected. That means checking how your backup provider handles ransomware, whether your access controls are properly configured, and whether you have any redundancy if your primary copy is taken out. For practices handling sensitive client data, the cybersecurity considerations around backup are just as important as the backup itself. If you experience a breach and cannot demonstrate that reasonable steps were taken to protect client data, you may have obligations to notify the Office of the Privacy Commissioner under the NZ Privacy Act 2020.
ITstuffed works with professional services businesses across Canterbury on exactly this. If you want a quick sense of where your current setup stands, a 15-minute IT Fit Check is a good place to start.