Cloud Ransomware: Soft-Delete and Versioning Are the Whole Story

You thought the cloud was looking after you?

There is a way to encrypt all of your storage, and then either you pay a ransom or you lose everything.

A lot of companies move everything to the cloud and feel protected by magic – as though the moment the data sits with some cloud giant, somebody up there is taking care of it. Delusion.

I saw this up close on a cloud assessment a few months ago

There was one Service Principal with permissions that were too broad, leaked by accident through an old configuration. With that token in hand, we could reach the company’s entire Blob storage. Not just to read. To delete, to replace, and to encrypt.

And without the right recovery teams in place, that is exactly the moment the conversation turns to ransom.

Four ways to attack cloud storage

• Re-encrypt the files with a key only the attacker holds.
• Simply delete everything and demand a ransom for the backup they stole first.
• Play with the lifecycle policy so the data deletes itself within a few days.
• Steal the encryption keys themselves and lock you out of your own key.

Each of them sounds technical, but in the business the meaning is one thing only: a day the business does not work.

And here is the difference most people miss

The difference between “we restored it in five minutes” and “we paid the ransom” is not a sophisticated defensive tool. It is two boring things nobody likes talking about: soft-delete and versioning.

When they are on, even if an attacker deleted or encrypted a file, the old version is still there. You click restore and carry on working. When they are off, there is nowhere to go back to. Only the attacker has a copy, and he wants money.

Add immutability on top – a lock that prevents changing or deleting the backup for a period you define – and you have a real safety net.

Now let’s talk numbers, because that is what moves managers

One hour of downtime at a mid-sized company easily costs tens of thousands of shekels, whether that is sales that stopped, customers who left, or a whole team sitting at zero.

Turning on soft-delete, versioning and immutability in advance costs almost nothing. A few hours of configuration, and a negligible storage cost for the versions.

That is the equation. A few hours of work now, against a week of chaos and a ransom later.

The cloud is a remarkable tool. But it is not a parent tucking you in at night. It gives you all the buttons and waits for you to press them. You, not it.

So a simple question: go and check right now – are soft-delete and versioning on your storage switched on, or off?

I first shared a version of this as a LinkedIn post on 2026-07-07. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula