Immutable backups against ransomware

The deliberate attack pattern: encrypt or delete the backups, then production

Modern ransomware operators have professionalized their playbook. Before triggering the encryption payload on production, attackers spend days mapping the network in search of gaps in network security: identifying the backup server, employees' credentials and passwords left in scripts, and the access policy protecting each repository. Once they gain access and are in position, they disable or delete those copies first, then encrypt production data.

The sequence is deliberate. A business that can restore in a few hours has little incentive to pay; one whose copies were wiped days earlier has no such option, and the attacker is counting on it. An attack of this kind isn't only about encrypting data, it's about removing every restore path a company has.

This is why a single compromised credential is now the biggest risk in a protection strategy. Access control and your identity, security and operations protections are the first line of defense, but hackers and unauthorized access attempts don't stop there: an account with write access to a storage bucket can delete every object and every retention date within minutes, unless something in the storage layer itself refuses that instruction.

Close the access path: MFA, phishing awareness and restore drills

Immutability protects the copy, but it does not protect the door the attacker came through. Nearly every incident starts with a stolen credential, and phishing remains the most common delivery method, usually an email that looks routine. Three controls matter around the storage layer itself.

Require MFA on the storage console and on every account that can change a retention policy. Multi-factor authentication is the single highest-value control here, because MFA breaks the credential-replay step that cyber attacks of this kind depend on, and MFA on the console is quick to roll out. Keep service credentials in a password manager, not in scripts, and check that password rotation actually happens. Give staff regular training sessions on suspicious email and password managers, so an employee who receives one reports it instead of opening it. Staff who know the threat model are a cheaper defense than any product, and threats reaching an informed employee usually stop there, and an employee report is often the earliest signal an employee gives you. And run a restore drill on a regular schedule: the only way to identify a broken recovery path is to exercise it before an incident does. Track delete attempts on the bucket too: a spike in refused deletions is a reliable early signal that credentials have been compromised. Track policy updates as well, since retention updates are what an attacker tries first.

None of this replaces network segmentation or endpoint protection on the production side, and it is not a full cybersecurity framework. It is the layer that keeps a single compromised employee account from becoming a company-wide outage.

Cyber-insurance and audits now require demonstrable immutable copies

Insurers renewing cyber policies now ask direct questions: are those copies immutable, are they logically isolated from production, and can you demonstrate a successful restore test? Businesses that can't answer with evidence face higher premiums or a declined policy. Most businesses discover this at renewal, not before. The first step is to establish and document your backup restoration processes, then conduct regular restore tests and ongoing monitoring to ensure they still work as your environment changes.

Compliance requirements have moved the same direction, and so have customer data security questionnaires. Whether it comes from ISO 27001 controls, sector-specific audits, or a customer's own risk assessment, "we have backups" is no longer an acceptable answer. Every organization facing modern cyberattack threats increasingly needs to prove that a backup copy cannot be altered or deleted for a defined retention period, regardless of which employees or accounts try.

That evidence matters because an immutable backup measurably reduces the chance that one compromised credential destroys both production and its restore path. The bar has moved from "a backup exists" to "we can demonstrate a restore path that an attacker cannot easily destroy."

Three copies, two media types, one offsite (and one immutable)

The 3-2-1 rule, three copies on two media types with one offsite, has anchored data protection for a decade, and the logic holds: if one system or location fails, another path remains.

Ransomware changes the calculation. If an attacker can reach every copy through the same credentials or the same network path, "offsite" alone doesn't protect your business; it just moves the risk somewhere else. That's why many businesses and backup teams now treat the rule as 3-2-1 plus one immutable copy: a backup that survives even after the rest of the environment has been compromised.

What 'immutable' actually means at the object-storage layer

Immutability isn't a setting inside your software, it's a guarantee enforced by the storage layer. With Object Lock enabled and a retention period set, the system refuses any delete or overwrite until that period expires, including requests made with valid administrator access.

It doesn't matter whether the request uses a valid employee password, a compromised account, or the ransomware payload itself: the system, by design, won't allow the change. That protects the copy from the exact technique this malware relies on, using stolen access to modify or erase whatever it can reach.

11 nines of durability, and a 99.99% Availability SLA on 3-AZ

A backup you can't restore quickly isn't much use. All OVHcloud Object Storage infrastructure is designed for eleven nines of durability (99.999999999%), not only the 3-AZ regions, so data loss from hardware failure is extraordinarily unlikely wherever the copy sits. The 99.99% Availability SLA applies to the 3-AZ deployment mode. Administrators need the restore target to be there when a security incident hits, not just proof the data was safe beforehand. It's also the dimension customers rate highest: Stability at 4.51/5 and Availability at 4.50/5 in NPS scores.

No egress fees on restore between OVHcloud services

Restoring a large volume of data after an incident shouldn't add an unpredictable bill to an already costly event. There are no egress fees between OVHcloud services, so restoring to a Public Cloud instance, a Bare Metal server or any other OVHcloud resource carries no separate transfer charge, and the cost of a restore stays predictable. That makes recovery easier to budget for when time matters most.

Tier your retention to control cost: Standard → Active Archive → Cold Archive

Not every copy needs the same storage class for the same length of time. Lifecycle policies move objects from Standard into Active Archive for medium-term retention, then Cold Archive for regulatory retention, while Object Lock stays in force across every class.
Active Archive costs around €4.5 per TiB and Cold

Archive around €1.7 per TiB, both well below Standard for data you rarely restore. That tiering lets your company keep a multi-year immutable retention policy for compliance, matching most industry requirements, without paying premium storage rates the whole time. Regularly review and update the lifecycle policy as retention requirements or data volumes change.

Sovereignty and compliance: GDPR, HDS, ISO 27701, no CLOUD Act exposure

Backup data often holds some of a company's most valuable and sensitive information: database dumps, application state, intellectual property, full system snapshots, and sometimes personal data covered by GDPR. Where that data lives, and which legal jurisdiction applies, matters for digital sovereignty, data protection, and for sector-specific requirements such as HDS or ISO 27701, including for critical infrastructure operators and regulated industries.

OVHcloud Object Storage is hosted and operated in European data centers, with no CLOUD Act exposure, since OVHcloud isn't a company subject to that law's disclosure requirements. Current certifications include ISO 27001, 27017, 27018, and 27701 for privacy management, with SecNumCloud qualification for Object Storage on the roadmap. That turns this storage into part of the organization's broader risk management, compliance posture, and business operations, not just an operational utility.