🎯 In 30 seconds: Keep three copies of what matters, on two kinds of storage, with one copy away from home. Make at least one copy something ransomware can’t reach (unplugged, or a cloud service that keeps old versions). Test a restore twice a year. A backup you have never restored is a hope, not a backup.
The 3-2-1 rule
| 3 copies | The original plus two backups. |
| 2 kinds of storage | For example, an external hard drive and a cloud service, so one failure doesn’t take both. |
| 1 off-site | A copy outside your home or business, so a fire, flood or burglary doesn’t take everything. |
CISA recommends this rule for home users and small businesses, with backups that run automatically and on a schedule.
What to back up
| Item | Why it matters | Note |
|---|---|---|
| Photos and videos | Can’t be replaced. | The largest files; check that your phone’s cloud backup is actually on. |
| Tax returns and supporting papers | You may need several years of records if the IRS asks. | Scan paper; keep PDFs of filed returns. |
| Identity and legal documents | Wills, deeds, insurance policies, passports, birth certificates. | Encrypt these; they are a thief’s starter kit. |
| Business books and invoices | You can’t bill or file without them. | Know how to export from your accounting software. |
| Password manager vault | Losing it locks you out of everything. | Most managers sync; also keep the emergency kit on paper. |
Ransomware, in plain words
Ransomware is malicious software that scrambles your files and demands payment for the key. Many versions hunt for backups they can reach and scramble those too. It usually arrives through a phishing email, a fake download, or an unpatched computer or router.
- Prevention: automatic updates, two-step login on email and remote access, and care with attachments.
- Backups it can’t reach: CISA recommends offline, encrypted backups that you test regularly. For a home, that can be an external drive you plug in for the backup and then unplug, plus a cloud service with version history.
- Small business extras: CISA suggests being able to roll data back at least seven days, and testing both a full and a partial restore.
If it happens
- Isolate: unplug the affected computer from the network and turn off its Wi-Fi. CISA lists this as the first step.
- Don’t wipe yet: photograph the ransom note.
- Report to IC3.gov or your local FBI field office. The FBI does not support paying a ransom, since paying doesn’t guarantee you get your data back.
- Restore from a clean backup onto a cleaned or rebuilt machine, then change passwords from a clean device.
A worked example: a family with 600 GB
A household has 540 GB of photos and video, 40 GB of documents and 20 GB of business files: 600 GB in total.
- Copy 1: the original, on the laptop and phones.
- Copy 2: a 2 TB external drive, filled by the computer’s built-in backup tool on the first Sunday of each month, then unplugged and put in a drawer. 600 GB uses less than a third of it, leaving room for growth and older versions.
- Copy 3: a cloud backup or sync service with version history, sized to hold the 600 GB.
- Test: each April and October, restore one folder of photos and last year’s tax return to a different folder and open them.