Many business owners assume that storing files in cloud folders means their company is safe from data disasters. You use OneDrive, Google Drive, or Dropbox daily, the sync icon shows green on your desktop, and you conclude that your critical data is securely backed up.
That assumption is a dangerous trap.
Ransomware does not just encrypt local files on the laptop of an employee who clicked a rogue link. Its primary goal is to paralyse business operations until a ransom is paid. Automatic cloud sync, far from acting as a barrier, frequently acts as the primary conduit for spreading the encryption across your entire network.
If you run an SME, understanding the distinction between live cloud synchronisation and a true, isolated backup is often the only difference between an inconvenient afternoon and weeks of operational paralysis.
Automatic synchronisation: how ransomware hits the cloud in seconds
Cloud storage services are engineered for seamless collaboration. Their job is simple: make sure any edit made in the office appears instantly on your home laptop or your colleague's tablet.
The problem arises when malicious software encrypts your files locally. Ransomware does not simply delete your documents; it rewrites them using complex encryption keys, rendering them unreadable while renaming their extensions.
To the sync agent installed on your computer (such as the desktop client for Microsoft 365 or Google Workspace), this encryption looks like standard file activity. Its logic is entirely automated:
- It identifies that local files have been modified.
- It instantly uploads the newly encrypted versions to the cloud servers.
- It overwrites the clean files previously stored online.
- It pushes the encrypted versions out to every other machine linked to that shared drive.
Within minutes, clean spreadsheets, contracts, and customer databases are replaced across your company by locked files. Your staff are locked out simultaneously.
The reality of version history and the recycle bin
When this happens, many directors assume they can simply roll back changes using built-in cloud version history.
While version history is helpful when someone accidentally deletes a paragraph in a proposal, it is rarely an effective disaster recovery tool during a widespread cyberattack.
Bulk restoration creates severe downtime
Ransomware attacks encrypt tens of thousands of files within minutes. Most commercial cloud suites do not offer an intuitive single-click button to revert thousands of shared folders back to a specific minute across an entire tenant without errors.
Restoring data often requires navigating file structures manually or running complex scripts that take hours or days to complete. If your business has 40,000 files affected, manually approving version rollbacks is operationally impossible while trade is ground to a halt.
Attackers actively target your cloud portal
Modern ransomware payloads harvest credentials stored in web browsers on compromised endpoints. If an attacker secures access to a session with administrative rights in your cloud tenant, they will deliberately purge retention bins and disable versioning settings before triggering the payload.
If the compromised account holds broad administrative permissions, your cloud safeguards can be disabled with a few clicks from inside your own dashboard.
The 3-2-1 backup rule for modern threats
To withstand a ransomware attack, a backup system must follow two strict rules: immutability and separation.
The reliable industry baseline is the 3-2-1 rule, refined for modern threats:
- Three copies of your data: the primary production data you use daily, plus two distinct backup copies.
- Two different storage media: avoid relying on a single vendor or architecture for both your daily work and your disaster recovery.
- One off-site, immutable copy: this is the non-negotiable component. At least one backup must be completely unreachable from standard office logins and protected by write-once, read-many (WORM) policies so it cannot be altered or wiped for a defined period.
An immutable backup ensures that even if an attacker gains full control of your local network and your standard cloud drives, the snapshot remains locked and ready for a clean restore.
Excessive permissions: the open door across your departments
A frequent weakness in UK SMEs is granting staff wide access across company drives to avoid managing permissions. Everyone has read and write access to the main directory because it feels more convenient.
This open structure turns a minor incident into a total outage:
- If a front-desk laptop is infected through a phishing email, the ransomware immediately reaches HR records, director accounts, and financial databases because that laptop had full access rights.
- If permissions are strictly confined to what each role actually requires, an infection remains contained within that specific user's folder, allowing the rest of the team to continue trading.
Applying the principle of least privilege is not a matter of workplace mistrust; it is a fundamental control to minimise operational exposure.
Checklist: would your backups survive an attack tomorrow?
Review your current setup against these basic resilience checks:
- Air-gapped or immutable: Are your backups segregated from the synchronised folders running on staff computers?
- Tamper-proof retention: Do you have a storage location where files cannot be deleted or overwritten for at least 30 days, even with administrative access?
- Separate credentials: Does your backup solution rely on entirely different accounts and passwords from your standard Microsoft 365 or Google logins?
- Enforced MFA: Is multi-factor authentication (via authenticator app, not SMS) mandatory across every administrative account?
- Routine restore tests: Have you executed a full data restore test on a clean machine within the last six months to verify recovery speeds?
If you answered «no» or «unsure» to any of these points, your business remains exposed to significant disruption in the event of an attack.
Review your security before an attack occurs
Finding out your backups do not work while staring at a ransom note is a devastating scenario for any managing director. By that stage, operational disruption, regulatory reporting, and potential client loss carry far greater costs than proper prevention.
At Herion, we deliver independent cybersecurity audits that assess your cloud configuration, access permissions, and backup defences under real-world conditions. We do not just hand you a list of problems; we implement the fixes and re-test them to ensure they hold.
To evaluate your business's exposure without technical jargon, book a free express diagnostic with our team.