The 3-2-1 Backup Rule: How to Beat Ransomware Without Paying a Cent

Ransomware negotiators will tell you the same thing every time: the victims who walk away without paying are not the ones with the best antivirus. They are the ones with a working backup.

Everything else in security is about preventing an attack. Backup is the only control that decides how bad it is when prevention fails — and prevention eventually fails for everyone.

What the 3-2-1 Rule Actually Means

It is the oldest and most reliable backup principle in existence, and it survives because it defeats every common failure mode at once.

• 3 copies of your data. The original plus two backups. Two copies protect against one failure; three protect against the failure that happens while you are restoring from the second.
• 2 different types of media. Do not keep both backups on identical drives bought on the same day. Drives from the same batch fail at similar times. Mix an external drive with cloud storage, or an SSD with a network drive.
• 1 copy offsite. Fire, flood, and theft do not distinguish between your laptop and the external drive sitting next to it. One copy must live somewhere else, whether that is the cloud or a drive at a relative's house.

The Modern Update: 3-2-1-1-0

Ransomware changed the requirements, because it actively hunts for backups before it encrypts anything. Two extra numbers were added:

• 1 copy offline or immutable. A drive that is unplugged cannot be encrypted. Immutable cloud storage cannot be overwritten or deleted for a set period, even by someone holding your password.
• 0 errors. The backup must be verified by actually restoring from it. An untested backup is a hope, not a plan.

That offline copy is the part that matters most. Modern ransomware waits, watches which drives are connected, deletes shadow copies, hunts for network shares, and encrypts backups first so you have no option but to pay.

Why Cloud Sync Is Not a Backup

This is the most expensive misunderstanding in personal computing. A sync service mirrors changes. When ransomware encrypts your local files, the sync client dutifully uploads the encrypted versions and overwrites your good copies.

Sync is convenience. Backup is a separate, versioned, ideally offline copy that ransomware cannot reach.

Cloud sync services do keep file version history, which can save you — but the retention window is limited, restoring thousands of files one version at a time is painful, and some ransomware deliberately makes enough changes to exhaust the version history.

Building Your Backup System

Step 1: Decide What Cannot Be Replaced

Photos, videos, documents, tax and legal records, project files, password manager exports, and configuration you would hate to rebuild. Applications and the operating system can be reinstalled — your data cannot.

Step 2: Set Up an Automatic Local Backup

Windows users can use File History or a third-party imaging tool. Mac users have Time Machine. Point it at an external drive and let it run continuously. This is the copy you use for everyday accidents: a deleted folder, a corrupted file, a failed drive.

Step 3: Add a Cloud Backup

Choose a real backup service rather than a sync folder, and enable versioning with the longest retention you can get. This is your offsite copy. Encrypt sensitive data before it leaves your machine if the provider does not offer zero-knowledge encryption.

Step 4: Create the Offline Copy

Buy a second external drive. Once a month, plug it in, run the backup, and unplug it. Store it somewhere away from your computer. This drive is your insurance against the worst day, and it works precisely because it spends 99 percent of its life disconnected.

Step 5: Test the Restore

Every three months, pick a few random files and restore them to a different location. Open them. Confirm they are intact and complete.

Also do one full restore test each year if you can. Most backup failures are discovered during an emergency, which is the worst possible time to learn that the job had been silently failing for eight months.

Common Backup Mistakes

• Leaving the backup drive permanently connected. It is then just another folder for ransomware to encrypt.
• Never checking whether the job is running. Backup software fails quietly. Look at the last-success date once a month.
• Backing up only Documents. People forget the desktop, downloads, email archives, browser bookmarks, and application data.
• No versioning. If your backup only holds the latest state, and you back up after the ransomware runs, you have overwritten your only good copy.
• Storing backup credentials on the machine being backed up. An attacker with your computer then has your backup too.
• Assuming the phone is covered. Check that photos, messages, and authenticator data are actually being backed up somewhere you can restore from.

If Ransomware Hits

1. Disconnect the device from every network immediately, including Wi-Fi, ethernet, and any external drives.
2. Do not pay first and think later. Payment funds the next attack and roughly a third of victims never get usable files back.
3. Photograph the ransom note and record the file extension used. Free decryptors exist for many strains through the No More Ransom project.
4. Report it to your national cybercrime authority.
5. Wipe the machine completely and reinstall the operating system. Do not restore into a compromised system.
6. Restore from your offline backup, then change every password from a clean device.

The Bottom Line

Three copies, two media types, one offsite, one offline, zero unverified backups. It costs roughly the price of two external drives and one evening of setup.

Do it this weekend. Not because an attack is likely this month, but because the version of you dealing with a ransom note will have no other options left.