Backup destruction is the deliberate deletion, corruption, encryption, or disabling of backup copies and recovery tools. Attackers may also target backup credentials, management consoles, or network paths so defenders cannot restore systems after an intrusion.
In ransomware attacks, damaging backups can prolong outages and increase pressure to pay. Defenses include restricting and monitoring backup access, keeping isolated or immutable copies, protecting recovery credentials separately, and regularly testing restoration. These measures help ensure recovery remains possible even if production systems or connected backup infrastructure are compromised.