Provable Resilience: The Ransomware Control M&S Didn’t Have
Author
Zeen Rachidi
Date Published
In April 2025, British retail giant Marks & Spencer (M&S) fell victim to a sophisticated ransomware attack by the group Scattered Spider. The breach brought online operations to a standstill, crippled inventory systems, and left store shelves empty as the company resorted to manual workarounds. The impact was staggering: over £1 billion in market value was erased, and an estimated £300 million was hit to operating profit.
This wasn’t a failure of detection. It was a failure of recovery.
The M&S incident highlights a hard truth: ransomware resilience isn’t just about having the right tools — it’s about proving you can recover. In today’s enterprise environment, backups alone aren’t enough. You must be able to demonstrate—to your board, auditors, and insurers—that your data is intact, uncorrupted, and restorable in the event of a ransomware attack.
M&S had backups. But they couldn’t recover in time. The result? A prolonged, costly disruption that no organization can afford.
The New Threat Model: Ransomware Targets Recovery First
Ransomware has evolved. It’s no longer just about encrypting production systems and demanding payment.
Today’s attackers go after what gives you leverage: your backups. Sophos reports that 94% of ransomware incidents now include attempts to compromise backup systems, and more than half of those attempts succeed. These aren’t opportunistic strikes; they’re calculated, methodical campaigns aimed at one objective: preventing recovery.
The logic is straightforward. If your backups are gone or corrupted, you’re far more likely to pay. Victims with compromised backups are nearly twice as likely to succumb to ransom demands — yet even then, recovery remains uncertain. According to CyberEdge, only 54% of those who pay get all their data back.
Bottom line: having backups isn’t enough. The new standard isprovable, tamper-proof, ransomware-aware data recoveryprovable, tamper-proof, ransomware-aware data recovery. Anything less is a risk.
Marks & Spencer: A Cautionary Tale for Risk Committees
When M&S disclosed the breach in late April 2025, operations were already in chaos. Online orders were suspended. Contactless payments and Click-and-Collect were shut down. Employees reverted to pen-and-paper processes. Even by late May, full e-commerce service had not been restored. Even by late May, the company still hadn’t restored full e-commerce service.
The company reportedly refused to pay the ransom, a principled and government-aligned decision. But without fast and provable clean data recovery options, they had no choice but to rebuild from scratch. Systems were reimaged. Applications reinstalled. Data painstakingly recovered from partial sources.
What followed was a months-long outage, a media firestorm, and a significant setback in M&S’s turnaround strategy. The company described the attack as “unlucky.” In truth, this was not about luck. It was about missing controls.
Provable ransomware readiness is now a board-level mandate. When recovery isn’t fast, clean, and provable, the business pays the price.
The Backup Illusion: “We Had Backups” Isn’t Enough
Many organizations are lulled into a false sense of readiness. They assume that because backups exist, recovery is assured. But the data tells a different story:
- Thirty-one percent of organizations with recent backups were unable to recover after a ransomware attack fully
- On average, 43% of affected data is permanently lost after ransomware incidents (The Journal, date and article name required).
- Only 26% of companies whose backups were hit recovered operations within one week, compared to 46% when backups remained intact.
Even worse: 63% of organizations risk re-infecting themselves during recovery because they restore from backups that were never scanned for ransomware or encryption artifacts.
These numbers aren’t IT problems; they're audit findings waiting to happen. Your ability to recover must not only exist, but also be demonstrable, provable, and regularly tested.
Treat Recovery as a Security Control
Here’s what a ransomware-resilient recovery posture looks like in 2025:
Immutable Storage
Backups that can’t be altered or deleted by ransomware, whether stored in the cloud (e.g., AWS S3 Object Lock) or on-premises with WORM or air-gapped infrastructure.
Continuous Integrity Scans
Every backup is scanned for ransomware, insider threat encryption, dormant malware, and file system corruption. Not just before recovery but continuously.
Access Separation
Backup systems are isolated from primary networks. Admin credentials not reused. MFA is enforced on all access points.
Restore Testing
Routine restore tests are conducted in safe environments to validate the completeness, performance, and time-to-recovery (RTO) of the restore process. Evidence is logged and reviewed.
Recovery Workbooks and Runbooks
Documented, rehearsed workflows for restoring critical applications in priority order. Maintained and versioned.
Real-Time Resilience Metrics
KPIs that measure how many assets have clean recovery points within SLA, time to last clean snapshot, and encryption trends across backup sets.
These are not optional enhancements; they are controls. Just as you can’t claim identity protection without MFA, you can’t claim ransomware resilience without a provable ability to recover from a known-clean backup.
A Word from the Front Lines
As M&S CIO Jeremy Pee noted after the attack:
“We’ve had to re-architect and accelerate parts of the digital transformation – what was a two-year program is now being done in six months.”— CIO.com
In plain terms: when recovery fails, the business must pivot under duress. Systems are rushed. Budgets are scrambled. Priorities shift from innovation to reconstitution.
That’s not resilience, that’s survival mode. No organization should wait until after an attack to discover that its recovery was merely theoretical.
Provable Recovery is a Strategic Advantage
Resilient finance and retail institutions don’t just need cybersecurity. They also require effective risk management. They need cyber survivability. They need to be able to tell their boards, regulators, and shareholders:
- “We know how much data we’d lose in a worst-case event.”
- “We can prove how long recovery would take.”
- “We can show which systems are covered — and which aren’t.”
- “We scan for ransomware and insider threat encryption every day — not just after the fire.”
This is the language of operational resilience. And increasingly, it’s becoming the language of compliance, insurance underwriting, and investor due diligence.
Final Thought
Ransomware isn’t going away. But the catastrophic consequences can be prevented — not with wishful thinking, but with controls that make resilience provable.
When the next attack comes, and it will, your backups will either be your lifeline or your liability.
The difference lies in whether recovery is merely a checkbox or a proven security control.
Elastio is the Ransomware Recovery Assurance Platform. We continuously verify, score, and track your backups to ensure they are clean, recoverable, and ransomware-free — even in the face of insider threats or sophisticated encryption attacks. Our platform provides real-time integrity scanning, provable clean snapshots, and automation for fast recovery, so your last line of defense is your strongest.
Recover With Certainty
See how Elastio validates every backup across clouds and platforms to recover faster, cut downtime by 90%, and achieve 25x ROI.
Related Articles
Cloud ransomware incidents rarely begin with visible disruption. More often, they unfold quietly, long before an alert is triggered or a system fails. By the time incident response teams are engaged, organizations have usually already taken decisive action. Workloads are isolated. Instances are terminated. Cloud dashboards show unusual activity. Executives, legal counsel, and communications teams are already involved. And very quickly, one question dominates every discussion. What can we restore that we actually trust? That question exposes a critical gap in many cloud-native resilience strategies. Most organizations have backups. Many have immutable storage, cross-region replication, and locked vaults. These controls are aligned with cloud provider best practices and availability frameworks. Yet during ransomware recovery, those same organizations often cannot confidently determine which recovery point is clean. Cloud doesn’t remove ransomware risk — it relocates it This is not a failure of effort. It is a consequence of how cloud architectures shift risk. Cloud-native environments have dramatically improved the security posture of compute. Infrastructure is ephemeral. Servers are no longer repaired; they are replaced. Containers and instances are designed to be disposable. From a defensive standpoint, this reduces persistence at the infrastructure layer and limits traditional malware dwell time. However, cloud migration does not remove ransomware risk. It relocates it. Persistent storage remains long-lived, highly automated, and deeply trusted. Object stores, block snapshots, backups, and replicas are designed to survive everything else. Modern ransomware campaigns increasingly target this persistence layer, not the compute that accesses it. Attackers don’t need malware — they need credentials Industry investigations consistently support this pattern. Mandiant, Verizon DBIR, and other threat intelligence sources report that credential compromise and identity abuse are now among the most common initial access vectors in cloud incidents. Once attackers obtain valid credentials, they can operate entirely through native cloud APIs, often without deploying custom malware or triggering endpoint-based detections. From an operational standpoint, these actions appear legitimate. Data is written, versions are created, snapshots are taken, and replication occurs as designed. The cloud platform faithfully records and preserves state, regardless of whether that state is healthy or compromised. This is where many organizations encounter an uncomfortable reality during incident response. Immutability is not integrity Immutability ensures that data cannot be deleted or altered after it is written. It does not validate whether the data was already encrypted, corrupted, or poisoned at the time it was captured. Cloud-native durability and availability controls were never designed to answer the question incident responders care about most: whether stored data can be trusted for recovery. In ransomware cases, incident response teams repeatedly observe the same failure mode. Attackers encrypt or corrupt production data, often gradually, using authorized access. Automated backup systems snapshot that corrupted state. Replication propagates it to secondary regions. Vault locks seal it permanently. The organization has not lost its backups. It has preserved the compromised data exactly as designed. Backup isolation alone is not enough This dynamic is particularly dangerous in cloud environments because it can occur without malware, without infrastructure compromise, and without violating immutability controls. CISA and NIST have both explicitly warned that backup isolation and retention alone are insufficient if integrity is not verified. Availability testing does not guarantee recoverability. Replication can accelerate the blast radius Replication further amplifies the impact. Cross-region architectures prioritize recovery point objectives and automation speed. When data changes in a primary region, those changes are immediately propagated to disaster recovery environments. If the change is ransomware-induced corruption, replication accelerates the blast radius rather than containing it. From the incident response perspective, this creates a critical bottleneck that is often misunderstood. The hardest part of recovery is deciding what to restore The hardest part of recovery is not rebuilding infrastructure. Cloud platforms make redeployment fast and repeatable. Entire environments can be recreated in hours. The hardest part is deciding what to restore. Without integrity validation, teams are forced into manual forensic processes under extreme pressure. Snapshots are mounted one by one. Logs are reviewed. Timelines are debated. Restore attempts become experiments. Every decision carries risk, and every delay compounds business impact. This is why ransomware recovery frequently takes days or weeks even when backups exist. Boards don’t ask “Do we have backups?” Boards do not ask whether backups are available. They ask which recovery point is the last known clean state. Without objective integrity assurance, that question cannot be answered deterministically. This uncertainty is not incidental. It is central to how modern ransomware creates leverage. Attackers understand that corrupting trust in recovery systems can be as effective as destroying systems outright. What incident response teams wish you had is certainty What incident response teams consistently wish organizations had before an incident is not more backups, but more certainty. The ability to prove, not assume, that recovery data is clean. Evidence that restoration decisions are based on validated integrity rather than best guesses made under pressure. Integrity assurance is the missing control This is where integrity assurance becomes the missing control in many cloud strategies. NIST CSF explicitly calls for verification of backup integrity as part of the Recover function. Yet most cloud-native architectures stop at durability and immutability. When integrity validation is in place, recovery changes fundamentally. Organizations can identify the last known clean recovery point ahead of time. Recovery decisions become faster, safer, and defensible. Executive and regulatory confidence improves because actions are supported by evidence. From an incident response standpoint, the difference is stark. One scenario is prolonged uncertainty and escalating risk. The other is controlled, confident recovery. Resilience is proving trust, not storing data Cloud-native architecture is powerful, but ransomware has adapted to it. In today’s threat landscape, resilience is no longer defined by whether data exists somewhere in the cloud. It is defined by whether an organization can prove that the data it restores is trustworthy. That is what incident response teams see after cloud ransomware. Not missing backups, but missing certainty. Certainty is the foundation of recovery And in modern cloud environments, certainty is the foundation of recovery.
CMORG’s Data Vaulting Guidance: Integrity Validation Is Now a Core Requirement In January 2025, the Cross Market Operational Resilience Group (CMORG) published Cloud-Hosted Data Vaulting: Good Practice Guidance. It is a timely and important contribution to the operational resilience of the UK financial sector. CMORG deserves recognition for treating recovery architecture as a priority, not a future initiative. In financial services, the consequences of a cyber event extend well beyond a single institution. When critical systems are disrupted and recovery fails, the impact can cascade across customers, counterparties, and markets. The broader issue is confidence. A high-profile failure to recover can create damage that reaches far beyond the affected firm. This is why CMORG’s cross-industry collaboration matters. It reflects an understanding that resilience is a shared responsibility. Important Theme: Integrity Validation The guidance does a strong job outlining the principles of cloud-hosted vaulting, including isolation, immutability, access control, and key management. These are necessary design elements for protecting recovery data against compromise. But a highly significant element of the document is its emphasis on integrity validation as a core requirement. CMORG Foundation Principle #11 states: “The data vault solution must have the ability to run analytics against its objects to check integrity and for any anomalies without executing the object. Integrity checks must be done prior to securing the data, doing it post will not ensure recovery of the original data or the service that the data supported.” This is a critical point. Immutability can prevent changes after data is stored, but it cannot ensure that the data was clean and recoverable at the time it was vaulted. If compromised data is written into an immutable environment, it becomes a permanently protected failure point. Integrity validation must occur before data becomes the organization’s final recovery source of truth. CMORG Directly Addresses the Risk of Vaulting Corrupted Data CMORG reinforces this reality in Annex A, Use Case #2, which addresses data corruption events: “For this use case when data is ‘damaged’ or has been manipulated having the data vaulted would not help, since the vaulted data would have backed up the ‘damaged’ data. This is where one would need error detection and data integrity checks either via the application or via the backup product.” This is one of the most important observations in the document. Vaulting can provide secure retention and isolation, but it cannot determine whether the data entering the vault is trustworthy. Without integrity controls, vaulting can unintentionally preserve compromised recovery points. The Threat Model Has Changed The guidance aligns with what many organizations are experiencing in practice. Cyber-attacks are no longer limited to fast encryption events. Attackers increasingly focus on compromising recovery, degrading integrity over time, and targeting backups and recovery infrastructure. These attacks may involve selective encryption, gradual corruption, manipulation of critical datasets, or compromise of backup management systems prior to detonation. In many cases, the goal is to eliminate confidence in restoration and increase leverage during extortion. The longer these attacks go undetected, the more likely compromised data is replicated across snapshots, backups, vaults, and long-term retention copies. At that point, recovery becomes uncertain and time-consuming, even if recovery infrastructure remains available. Why Integrity Scanning Must Happen Before Data Is Secured CMORG’s point about validating integrity before data is secured is particularly important. Detection timing directly affects recovery outcomes. Early detection preserves clean recovery points and reduces the scope of failed recovery points. Late detection increases the likelihood that all available recovery copies contain the same corruption or compromise. This is why Elastio’s approach is focused on integrity validation of data before it becomes the foundation of recovery. Organizations need a way to identify ransomware encryption patterns and corruption within data early for recovery to be predictable and defensible. A Meaningful Step Forward for the Industry CMORG’s cloud-hosted data vaulting guidance represents an important milestone. It reflects a mature view of resilience that recognizes vaulting and immutability as foundational, but incomplete without integrity validation. The integrity of data must be treated as a primary control. CMORG is correct to call this out. It is one of the clearest statements published by an industry body on what effective cyber vaulting must include to support real recovery.
Closing the Data Integrity Control Gap In 2025, the cybersecurity narrative shifted from protection to provable resilience. The reason? A staggering 333% surge in "Hunter-Killer" malware threats designed not just to evade your security stack, but to systematically dismantle it. For CISOs and CTOs in regulated industries, this isn't just a technical hurdle; it is a Material Risk that traditional recovery frameworks are failing to address. The Hunter-Killer Era: Blinding the Frontline The Picus Red Report 2024 identified that one out of every four malware samples now includes "Hunter-Killer" functionality. These tools, like EDRKillShifter, target the kernel-level "callbacks" that EDR and Antivirus rely on to monitor your environment. The Result: Your dashboard shows a "Green" status, while the adversary is silently corrupting your production data. This creates a Recovery Blind Spot that traditional, agent-based controls cannot see. The Material Impact: Unquantifiable Downtime When your primary defense is blinded, the "dwell time", the period an attacker sits in your network, balloons to a median of 11–26 days. In a regulated environment, this dwell time is a liability engine: The Poisoned Backup: Ransomware dwells long enough to be replicated into your "immutable" vaults.The Forensic Gridlock: Organizations spend an average of 24 days in downtime manually hunting for a "clean" recovery point.The Disclosure Clock: Under current SEC mandates, you have four days to determine the materiality of an incident. If you can’t prove your data integrity, you can’t accurately disclose your risk. Agentless Sovereignty: The Missing Control Elastio addresses the Data Integrity Gap by sitting outside the line of fire. By moving the validation layer from the compromised OS to the storage layer, we provide the only independent source of truth. The Control GapThe Elastio OutcomeAgent FragilityAgentless Sovereignty: Sitting out-of-band, Elastio is invisible to kernel-level "Hunter-Killer" malware.Trust BlindnessIndependent Truth: We validate data integrity directly from storage, ensuring recovery points are clean before you restore.Forensic LagMean Time to Clean Recovery (MTCR): Pinpoint the exact second of integrity loss to slash downtime from weeks to minutes. References & Sources GuidePoint Security GRIT 2026 Report: 58% year-over-year increase in ransomware victims.Picus Security Red Report 2024: 333% surge in Hunter-Killer malware targeting defensive systems.ESET Research - EDRKillShifter Analysis: Technical deep-dive into RansomHub’s custom EDR killer and BYOVD tactics.Mandiant M-Trends 2025: Median dwell time increases to 11 days; 57% of breaches notified by external sources.Pure Storage/Halcyon/RansomwareHelp: Average ransomware downtime recorded at 24 days across multiple industries in 2025.Cybereason True Cost to Business: 80% of organizations who pay a ransom are hit a second time.