Ransomware is a special form of malware that encrypts data on infected IT systems. Attackers subsequently demand payment of a ransom, claiming that they will then enable the victim to decrypt the data again. In the absence of backups, the encrypted data is lost in many cases or can only be recovered by paying the ransom. Even after the ransom is paid, however, there is no guarantee that the data can be recovered.

Many forms of ransomware look for network drives with write access in order to encrypt all their data, as well. This means that all encrypted information dating back to the most recent backup can be lost, even if a ransom is paid. Along with the IT system originally infected, this may affect centrally stored information accessed by multiple IT systems.

If backup storage media are not sufficiently secured, there is also the danger that they themselves will be affected by a ransomware attack and the information stored on them (backups) may be encrypted.