A database snapshot is a point-in-time copy of a database or volume that captures data as it existed at a specific moment. It is used for backup, testing, recovery, and replication, but it can also preserve sensitive content that would otherwise be transient, including customer records, service tokens, API keys, password hashes, or even deleted entries that remain recoverable in the snapshot.
In cyber security, snapshots matter because attackers value them as high-density loot: one file or image can expose large amounts of structured data and secrets. In extortion campaigns, stolen snapshots can be sold, leaked, or used to pressure victims even if live systems are restored. Defenders reduce this risk by encrypting backups, restricting snapshot access, separating backup credentials from production accounts, monitoring export activity, and regularly rotating any secrets that may have been captured.