The 3-2-1 Backup Rule: How to Make Your Files Ransomware-Proof in One Afternoon

On October 7, ransomware tore through IDC Frontier's IDCF Cloud in Japan. Around 495 organizations — including prefectural governments and a national news agency — lost services. The attackers claimed 225 databases, 239 hypervisors, and 16,000 virtual machine disks encrypted, with more than half a million snapshots deleted. The backups were inside the blast radius.

This is exactly the scenario the 3-2-1 backup rule exists to survive. And you can set it up in an afternoon.

The 3-2-1 backup rule, step by step

The rule is simple enough to fit on a sticky note: keep 3 copies of your data, on 2 different types of storage, with 1 copy offsite or offline. CISA's #StopRansomware Guide and NIST's backup guidance both treat it as the minimum acceptable architecture, not a nice-to-have.

Why three copies? Because any single copy can fail — a drive dies, a laptop gets stolen, ransomware encrypts everything it can reach. Two copies on the same desk die together in a fire. The offsite copy survives what the building doesn't.

The modern upgrade is 3-2-1-1-0: the same rule, plus one immutable or air-gapped copy (one that can't be rewritten even by an attacker), plus zero errors in verified restores. Some cyber-insurance policies now effectively require it. But if 3-2-1-1-0 sounds like too much, start with plain 3-2-1 — it's the difference between losing everything and losing a few hours.

Your cloud mirror is not a backup

This is the misconception that keeps biting people. A sync service — Google Drive, iCloud, Dropbox mirroring your files — faithfully copies damage everywhere. Ransomware encrypts your files? The sync client dutifully uploads the encrypted versions. Accidentally delete a folder? The deletion syncs. A mirror is a copy of the present; a backup is a way back to the past.

What makes a backup real is version history and separation: the ability to roll back to before the infection, on storage the malware can't reach. Modern ransomware actively hunts connected backups — network drives, mounted cloud folders, always-on external disks. The IDCF incident was the enterprise-scale version of this: snapshots lived inside the same environment the attackers owned.

Your afternoon setup plan

Copy one: the automatic local backup. On Windows, turn on File History. On macOS, plug in an external drive and let Time Machine do its thing. Set it to run daily. The rule for automation is simple: a backup you have to remember will eventually be forgotten.

Copy two: the cloud backup. Backblaze, iDrive, or Google's backup services give you the offsite copy automatically — one that survives theft, fire, and flood at home. Pick a service that keeps version history, not just a mirror of your current files. This distinction is the whole game.

Copy three: the offline one. An external drive you plug in for backups and then disconnect. Or write-once object-lock storage if you want to be fancy. The key word is offline: unplugged, unreachable, unencryptable by anything on your network. Once a week is fine for most people.

Don't forget the phone. iCloud or Google Photos backup plus a periodic full backup to your computer. A phone lost in a taxi is a data-loss incident with no malware required — and cloud sync alone isn't backup, as anyone who's watched a deletion propagate everywhere knows.

The NAS caveat. A Synology or QNAP with RAID protects against disk failure — one disk dies, you're fine. It does not protect against deletion, fire, or ransomware. Your NAS still needs its own offsite copy.

The step everyone skips: test the restore

An untested backup is just a hope with a hard drive attached. Once a quarter, pick a random folder and restore it. Make sure the files open. Make sure you remember how to do it when you're stressed — because the time you'll need this is the worst time to be learning.

If ransomware does hit: disconnect immediately, don't pay (no guarantee of recovery, and you're funding the next attack), check nomoreransom.org for free decryptors, wipe and restore from the offline copy, then report it. And check whether your data leaked elsewhere while you're at it.

The 3-2-1 backup rule won't make you invincible — nothing does. But it turns a ransomware attack from a catastrophe into a bad afternoon. The IDCF victims with offline copies are restoring. The ones without are negotiating. Which side of that line you're on is decided on an ordinary afternoon, before anything happens.