Backup deletion is the deliberate removal of restore copies, snapshots, archives, or backup catalog data so that a system cannot be rolled back after an incident. In cyber security, it is especially dangerous because backups are often the last reliable way to recover from ransomware, destructive malware, accidental deletion, or insider abuse.
Attackers may target backup servers, cloud storage, virtual machine snapshots, or the credentials used to manage them. They do this before or after encryption, sometimes disabling retention policies or erasing offline copies to raise pressure on the victim. Defenders reduce this risk with immutable backups, offline or air-gapped copies, separate administrative accounts, limited network access, and regular restore testing. A backup is only useful if an attacker cannot destroy it faster than it can be restored.