How to Keep Ransomware from Eating Your Backups

The worst moment in a ransomware attack is not the ransom note. It’s the discovery that comes right after: you plugged in your backup drive to check what you could recover, and the ransomware had already found it first.

This happens more often than people think. A backup only works if it survives the same attack that takes out your main copy. The good news is that protecting your backup takes no special software and no technical skill. It takes one habit: keep the backup drive disconnected when you’re not backing up.

Why your backup drive is a target

Ransomware encrypts every drive it can reach. That’s not a side effect — it’s the design. The malware walks through your PC and encrypts documents, photos, spreadsheets, everything on any drive that’s mounted at the time. A backup drive that’s plugged in is, to ransomware, just another folder full of files to lock.

Syncing to the cloud has the same problem from a different angle. If ransomware encrypts your files, the encrypted versions sync to OneDrive, Dropbox, or Google Drive right on schedule. The sync service isn’t broken — it’s doing exactly what you told it to do. Cloud sync mirrors damage as faithfully as it mirrors your work.

The fix isn’t another app or another subscription. It’s distance. A backup that the malware can’t reach can’t be encrypted. The old security phrase for this is “air gap,” and the home version is refreshingly low-tech: unplug the drive.

The routine: plug in, back up, unplug

This takes about ten minutes a week. It works with any backup tool that lets you choose a source folder and a destination drive — including BackupEasy.

1. Plug in your external drive. Connect the drive and give it a moment to show up. Don’t leave it connected longer than the backup takes.
2. Run your backup. Back up your folders the way you normally would — documents, photos, whatever matters. After the first full backup, follow-up runs copy only what’s changed, so a weekly run usually takes minutes.
3. Unplug the drive and put it somewhere else. Safely eject it, unplug it, and set it somewhere other than next to the PC — a desk drawer, a shelf, another room. The point is that it’s physically separated from your computer between backups.

That’s the whole routine. How often? Weekly is right for most people. If your files change every day — you run a business from the PC, or it’s the family’s photo and homework hub — back up twice a week or after any big batch of new files.

The thorough version: two drives. Get a second external drive and rotate them. One week you back up to Drive A; the next week to Drive B, while Drive A sits disconnected in a drawer. Now you always have a copy from last week that no attack could touch — even if you plugged in Drive B at the exact wrong moment. Two drives cost less than one panic.

The rest of the 3-2-1 rule, in plain language

Security people describe this routine with the 3-2-1 rule: 3 copies of your data, on 2 different media types, with 1 copy offsite. It sounds corporate, but it translates easily to a house.

Three copies means the original on your PC, plus two backups. The two-drive rotation above gives you exactly this.

Two different media types means don’t put both backups on the same kind of thing. An external drive plus a second drive from a different brand counts. An external drive plus a USB stick counts too.

One copy offsite means a copy that survives a fire, flood, or burglary — because ransomware is only one disaster. The honest options: keep one of your two drives at a family member’s place and swap it monthly, or use a cloud service with version history as your offsite copy. If you go the cloud route, check that your provider keeps version history — the old, pre-attack versions are your lifeline if encrypted files sync upward.

(October is Cybersecurity Awareness Month, which is a decent annual reminder to check that your offsite copy actually exists and works.)

If it happens anyway

No routine is perfect. If a ransom note ever appears on your screen, do these four things, in this order:

1. Disconnect. Pull the network cable or turn off Wi-Fi, and unplug any backup drives that are connected right now. This stops the malware from reaching clean copies and spreading to other devices. Do this before anything else.
2. Don’t pay. The FBI’s guidance is not to pay the ransom — paying doesn’t guarantee you get your files back, and it funds the next attack. Report the attack at IC3.gov, the FBI’s internet crime complaint center.
3. Check for free decryption. Visit nomoreransom.org, a free service from law enforcement and security firms. Don’t delete the ransom note — the note and the encrypted files together help identify which ransomware variant hit you, and some variants have free decryptors.
4. Clean and restore. Wipe and reinstall (or have someone you trust do it), then restore your files from the backup copy that was disconnected during the attack. That’s the payoff for the plug-in, back-up, unplug habit: there’s a clean copy waiting that the attack never touched.

Why BackupEasy fits this routine

Most backup tools assume you want everything automated — they run on a schedule, silently, in the background. That’s fine until you realize the schedule keeps the drive connected, or keeps trying to run when the drive isn’t there.

BackupEasy is built the opposite way. It’s manual, one click: pick your source folders, pick the drive, click Start. The first run copies everything; later runs are incremental, so a weekly backup takes minutes. Restore single files, whole folders, or the entire backup to any folder you choose. It’s honest about what it is — a file-backup tool, not a security suite. It doesn’t claim to detect or block ransomware. It does the one thing that matters here: it makes the backup half of the routine fast and simple, so you’ll actually do it.

Your files never leave your own drives. No account, no cloud upload, no subscription — $19.99 once for one PC, $29.99 for up to five, and the 60-day free trial is the full tool.

Start the routine this week: plug in a drive, back up, unplug it. Ten minutes, and the ransom note — if it ever comes — becomes a bad afternoon instead of a disaster.