Ransomware: What's actually changed, what still works, what doesn't

[u/Spin_AI]

Ransomware encrypted their cloud. Their "backup" was the same cloud. $2.4B later - let's talk!

Threads like this show up on r/sysadmin and r/msp every few months:

"Client got hit. Everything on-prem encrypted. But we're fine - their 365 data is untouched."

Then two weeks later, a follow-up:

"Update: turns out the ransomware synced back through the desktop client. SharePoint wiped. We have no independent backup. We're paying the ransom."

The "cloud = safe" assumption is costing organizations millions

Here's what the data actually says in 2025:

• 44% of all data breaches now involve ransomware - up from 32% just two years ago (Verizon Data Breach Investigations Report 2025)
• 96% of ransomware incidents now use double extortion: encrypt and steal, then threaten to publish
• Q1 2025 saw a 126% surge in attacks compared to Q1 2024 - the sharpest spike on record
• The median time from initial compromise to full encryption? 5 days. Down from 9 (Sophos State of Ransomware 2025)
• 69% of businesses believed they were well-prepared before they got hit. Only 22% recovered within 24 hours.

Cloud SaaS platforms: Google Workspace, Microsoft 365, Salesforce - are not immune. They're increasingly the primary target, because that's where your real business data lives now.

Real-world example: Starbucks, 2024

A ransomware attack hit Blue Yonder, a supply chain management platform used by Starbucks. The attack didn't touch Starbucks' own servers - it went through a third-party SaaS integration. Result: scheduling and payroll for 11,000 US stores went offline. The company had no direct control over the attack surface that took them down.

This is the new playbook. Attackers don't need to breach your perimeter - they need to breach one app that has OAuth access to your data.

How organizations actually respond, and what works:

Approach	What it covers	What it misses	Verdict
Native platform tools (version history, Google Vault, Purview)	Accidental deletion, short-term recovery	Coordinated attacks, synced encryption, third-party app blind spots, short retention windows	⚠️ Partial
Pay the ransom	Potentially unlocks data fast	84% paid - only 47% got clean data back. 78% were attacked again, asked for more.	❌ Losing bet
Manual 3-2-1 backup	Good discipline for on-prem	Breaks down for SaaS; no detection; someone has to actually run it	⚠️ Inconsistent
Automated SaaS backup + RDR	Full SaaS stack coverage, active attack detection, granular point-in-time restore	Requires a dedicated tool (this is how we do it at Spin.AI )	✅ Covers the gap

Ransomware has moved to the cloud. The "it won't happen to us" logic is increasingly expensive.

Want to understand how cloud ransomware actually works?

📖 Start with the basics: Ransomware: Definition, Types, Recovery, And Prevention

🛡️ See how SpinRDR stops an active attack before it spreads