Three Backup Horror Stories for Cybersecurity Awareness Month. A Helpful Lesson for ServiceNow Teams This Halloween.
October is Cybersecurity Awareness Month, which of course ends on Halloween. Yes, it’s hobgoblin season. Fitting, because the scariest stories in data protection are not fiction. They are consent orders, audit reports and settlement agreements. Here are three tales that will make your hair stand up, each with a different monster but the same tragic ending: the backup was not there when it was needed.
First Frightening Tale: The Backup Was in the House
On September 19, 2022, attackers used a cached remote-desktop shortcut to reach the Active Directory of Luk Fook Securities, a Hong Kong brokerage. From there, ransomware encrypted its file servers, domain controllers, email, trading application servers and accounting systems.
Luk Fook backed up its data daily, to an external hard drive that, according to the Securities and Futures Commission (SFC), was not consistently disconnected from the network. So, when the ransomware spread, it reached the backups too. The backups sat inside the blast radius: the full area an attack, or a single mistake, can damage before it is stopped.
Full recovery took until October 7, more than 14 days. In that time, clients could not trade through the firm’s app or internet platform and could only place orders manually through account executives. Their business continuity plan had never considered a ransomware attack, let alone losing their backups.
In July 2026, the SFC reprimanded Luk Fook and fined it HK$2.1 million, the regulator’s first fine for cybersecurity control failures. While the SFC found no evidence that any client lost money, they were fined anyway.
The moral: a backup the attacker can reach is not a backup you can rely on.
Second Scary Tale: The Backups That Wouldn’t Die
Blackbaud sells cloud software to nonprofits, universities, and healthcare organizations. In February 2020, an attacker logged into a Blackbaud-hosted database using one customer’s credentials and stayed inside for more than three months, until May 20th, well over 14 days.
According to the Federal Trade Commission (FTC), Blackbaud “did not encrypt its database backup files which contained complete customer records,” even for former customers, and kept data “for years longer than was necessary.” Blackbaud paid 24 Bitcoin in ransom, about $235,000, for the attacker’s promise to delete what was taken.
Then the rest of the very scary $59M bill arrived to complete Blackbaud’s horror story:
- $3 million to the SEC (2023) for misleading disclosures about the attack
- $49.5 million to 49 states and the District of Columbia (2023)
- $6.75 million to California (2024)
- FTC ordered Blackbaud to delete data it no longer needed and follow a retention schedule
Meanwhile, many of Blackbaud’s customers had to send breach notices to their own donors, patients and alumni. Their data sat in Blackbaud’s backups, but the notification duty stayed with them.
The moral: backups are data too. If they are unencrypted, kept forever and never governed, they are a horrifying liability waiting to rise from the grave.
Third Terrifying Tale: 8.7M Criminal Files Gone, and No Backup to Save Them
No attacker is needed for this one. In the spring of 2021, a City of Dallas IT administrator was moving archived police files from cloud storage to city servers in a cost-cutting project. Instead of being moved, the files were deleted due to an employee error.
By the time anyone stopped it, 8.7 million files, about 20.7 terabytes, were gone, and 7.5 terabytes could never be recovered. Nearly 17,500 criminal cases were potentially affected, and most of the lost files came from the family violence unit. The district attorney disclosed the loss four months later.
The city’s own audit found “poor policies, processes, planning and oversight,” and that Dallas had no rules for backups. The family violence victims were the real casualty in this sad tale of data loss. The employee was fired. Now two employees must oversee every data transfer, and deletions wait 14 days.
The moral: the most common data-loss event is not ransomware. It is a person with admin rights, a plan nobody checked, and no way back.
The Same Dangers Live in ServiceNow
Fortunately, none of these organizations was a ServiceNow customer. Yet, every failure could have happened to a ServiceNow instance.
ServiceNow’s native platform backup keeps weekly full backups for 14 days, and restore is a full-instance operation opened as a case with ServiceNow. It is built for infrastructure disaster recovery, not for these three scary tales, and since they lasted more 14 days, ServiceNow could not have restored the data natively:
- The reachable backup. If an attacker or rogue admin controls the instance, anything in the same environment, or one connected to it, is inside that blast radius.
- The ungoverned backup. HIPAA, SOX, FINRA and DORA care how your backups are encrypted, retained, and/or deleted, not just whether they exist.
- The fat-fingered deletion. When an errant script, tired administrator, or agentic workflow wipes records, a full-instance rollback also wipes every good change made since.
So, ask your ServiceNow team three questions before Halloween:
1. Is our backup outside the platform’s administrative control?
2. Is it encrypted with keys we hold and retained on a schedule we can defend?
3. Can we restore one table from Tuesday without rolling back the whole instance?
Don’t Become the Next Horror Story
Rezilient Restore was built to answer yes to all three. It captures every change to your ServiceNow data continuously, encrypts and streams it to immutable, off-platform storage that no administrator, script, agent or attacker can alter or delete from inside the instance. The data is encrypted on the ServiceNow platform with keys only you or ServiceNow hold; Rezilient cannot ever read or decrypt your data. And restore works at the record, field or table level, so recovering from a bad Tuesday does not cost you the rest of the week.
Our whitepaper, The Shared Responsibility Gap, maps NYDFS Part 500, DORA, HIPAA and SOX to what a compliance-grade ServiceNow backup program looks like. Back up now with our free 30-day trial.
Back Up Now. Restore Anytime. Always Rezilient.
