Ransomware and 3-2-1 copies: a restore beats a checkbox
Ransomware takes both production and the "rescue" if the copy sits in the same account. Meaning appears after a trial restore.
Ransomware is dangerous because it stops work, not because of the virus graphic. Small and mid-size businesses hit it regularly: a shared account, a mail to an employee, exposed remote access. If copies sit on the same disk or in the same hosting account, the attack takes both.
What 3-2-1 means in practice
- Three copies of the data, counting the live one.
- Two different kinds of media: not two files in one panel.
- One copy off the main plane, where the site account has no right to delete it.
- At least one timed restore: the site or the database, with the time written down.
The scheme without a trial restore stays a slogan. A typical failure looks like this: an archive exists, it is a year old, uploaded files are missing, and one person on leave knows the vault password. For a store or a portal, copies are part of protection, next to observation. Together they cut an outage from "several quiet days" to a known number of hours.
Lexora sets up backups and runs a restore test so confidence can be shown as a date, not as the sentence "we have backups".
Related Lexora services
Have you tried a restore this quarter?
If not, we start with copies that actually come back.