Federal agencies just confirmed that one of 2026's most active ransomware gangs doesn't just encrypt your data it hunts down and deletes your backups first, which means "we have backups" is no longer a safety net unless those backups are built to survive the attack itself.

A new field study of 800+ real-world ransomware recoveries found that only four organizations hit their 24-48 hour recovery target — and the reason usually wasn't missing backups, it was an untested, incomplete recovery plan.