Ask any business owner whether they have backups and you’ll almost always hear yes. Ask whether anyone has tested a restore in the last six months, and the room goes quiet. That gap is where ransomware does its real damage.
Modern ransomware crews don’t just encrypt your files. They spend days inside your network first, hunting for backups and destroying them, precisely because a business with working backups doesn’t pay. Federal agencies confirmed this pattern again this week in a joint advisory on the Gunra ransomware group, and a separate strain making the rounds — DeadLock — disables Windows Defender, deletes backups, and clears event logs before encryption even starts.
So the real question isn’t “do you have backups?” It’s “do you have backups an attacker sitting inside your network can’t reach?”
Why Most Small-Business Backups Fail
Here’s what we typically find when we take over IT for a business in Tyler, Longview, or Palestine that’s never had a real backup review:
The backup drive is plugged into the server. An external USB drive or a network share mapped with a drive letter is visible to ransomware the moment it runs. It gets encrypted right alongside everything else.
Backups run with domain admin credentials. If the backup account has full access to everything, an attacker who steals those credentials also has full access to your backups. This is the single most common way backup systems get destroyed.
Nobody checks the alerts. Backup jobs fail silently for months. The failure email goes to an employee who left in 2023, or to a folder nobody opens.
Only the file server is covered. Meanwhile the QuickBooks data, the practice management system, the CAD files on an engineer’s laptop, and the Microsoft 365 mailboxes aren’t backed up at all. Microsoft 365 is a big one — Microsoft replicates your data for availability, but that is not the same as a backup you can roll back after a deletion or compromise.
No one has ever tested a restore. A backup you’ve never restored from is a guess, not a plan.
The 3-2-1-1-0 Rule
The classic 3-2-1 rule still holds up, with two additions that ransomware made necessary:
- 3 copies of your data (the live copy plus two backups)
- 2 different types of storage (for example, local disk plus cloud)
- 1 copy stored offsite
- 1 copy that is offline, air-gapped, or immutable — meaning it cannot be altered or deleted, even by someone with administrator credentials
- 0 errors on your last verified restore test
That fourth item is the one that saves businesses. “Immutable” storage locks backup data for a defined retention window; not even the account that created it can delete it early. Most reputable backup platforms offer this now, often at no additional cost. If yours doesn’t, that’s worth a conversation.
What to Back Up (People Always Miss Something)
Walk your business and list every place data actually lives:
- Servers and workstations — including that one PC in the shop running the machine controller software
- Microsoft 365 or Google Workspace — email, OneDrive, SharePoint, Teams files
- Line-of-business applications — practice management, dealership DMS, legal case management, accounting, ERP
- Cloud platforms — anything SaaS holding records you’d be sued for losing
- Network device configurations — firewall and switch configs, so you can rebuild the network quickly
- Physical security systems — camera recorder configurations and retained footage, which are frequently overlooked and frequently subpoenaed
How Often, and How Far Back
Two numbers drive every backup decision:
Recovery Point Objective (RPO) — how much data you can afford to lose. If you back up nightly and get hit at 4 p.m., you lose a day of work. For a dental office in Lufkin, that might be tolerable. For a manufacturer in Longview running production scheduling, it isn’t.
Recovery Time Objective (RTO) — how long you can afford to be down. Restoring several terabytes over a rural internet connection can take days. If you need to be running in hours, you need a local copy to restore from and, ideally, the ability to spin up a server image temporarily while the full restore runs.
Pick those two numbers first. They determine what you actually need to buy — not the other way around.
Retention matters too. The Brown Health breach disclosed this month involved intrusion activity from December 2025 that wasn’t fully understood until June 2026. Attackers frequently sit in networks for months. If your backups only go back 14 days, your “clean” restore point may already be compromised. Keep monthly or quarterly restore points for at least a year.
Test Restores Like You Mean It
Set a recurring calendar reminder — quarterly is a reasonable floor:
- Pick a real file and restore it. Time how long it takes.
- Restore a full system to a test environment, not production.
- Verify the data actually opens and is current.
- Document who did it, when, and how long it took.
That documentation is worth its weight during an incident, and insurers and auditors increasingly ask for it. If you carry cyber insurance, read your policy — many now require immutable or offline backups and periodic testing as a condition of coverage. A denied claim after an attack is a painful way to learn that.
The East Texas Reality
Businesses across East Texas run leaner IT than their metro counterparts, and attackers know it. A county government, a rural hospital, a Texarkana defense supplier, an oilfield services company outside Palestine — all hold data worth extorting, often with no full-time IT staff and no one whose job it is to check whether last night’s backup succeeded.
Texas also raises the stakes legally. Under state law, businesses must notify affected Texans without unreasonable delay and no later than 60 days after discovering a breach, and incidents affecting 250 or more Texas residents must also be reported to the Texas Attorney General. Healthcare providers face HIPAA obligations on top of that, and defense suppliers risk their CMMC standing. Good backups don’t eliminate those duties, but they’re often the difference between a bad week and a closed business.
If you’re not certain where your backups stand, that uncertainty is itself the finding. Our managed IT services include monitored, immutable backup with documented restore testing, and our cybersecurity services cover the detection and response side so an intrusion gets caught before it reaches your backups. We serve businesses in Tyler, Longview, Palestine, Texarkana, Lufkin, and the DFW metro — reach out if you’d like a straight answer about your current setup.
This Week in Security
CISA and FBI issue joint advisory on Gunra ransomware (August 10). The #StopRansomware advisory (AA26-222A) warns that Gunra — built from leaked Conti source code and now operating as ransomware-as-a-service — is hitting healthcare, manufacturing, construction, transportation, government, utilities, and professional services. Initial access comes largely through known, unpatched vulnerabilities in internet-facing devices, which is a patching problem more than a hacking problem. (CISA)
Coryell County, Texas reports a technology disruption (August 6). The Central Texas county said several systems were affected while emergency and public-safety services stayed operational. The county hadn’t disclosed a cause as of reporting. Local governments remain steady targets, and small Texas counties rarely have deep IT benches. (Dysruption Hub incident registry)
Microsoft patches 421 vulnerabilities, including an actively exploited zero-day (August 11). CVE-2026-68820, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock, lets a locally authenticated attacker gain SYSTEM privileges. It’s under active exploitation — apply August updates promptly. (SecurityWeek)
Brown Health Medical Group breach affects roughly 311,000 people (disclosed August 4–6). Attackers accessed a legacy file server back in December 2025; the organization determined the scope in June 2026 and notified patients in August. Names, Social Security numbers, driver’s license numbers, medical records, and financial account details were exposed. Two lessons: decommission old file servers, and assume dwell time is measured in months. (SecurityWeek, Boston Globe)
Cyberattack disrupts cargo gate operations at North Carolina ports (August 10). Port operations were disrupted enough to affect cargo gates — a reminder that logistics and transportation vendors are part of your supply chain risk, even when the attack lands somewhere else. (Innovate Cybersecurity)
Dogwood Security LLC is a veteran-owned managed IT, cybersecurity, and physical security company based in Palestine, Texas, serving East Texas and the DFW metro.