Home  ›  Glossary  ›  Backup Tampering

Backup tampering

Backup tampering is unauthorized change to backup data, settings or metadata that makes recovery fail when it is needed: restore points wiped, retention shortened, jobs disabled or keys changed. It usually relies on a stolen administrator login and is designed to go unnoticed, since the backup system keeps reporting successful jobs.

What are the failure modes?

  • Retention reduction: retention is cut, for example from 30 days to one, and the scheduled cleanup then deletes older restore points over the following nights.
  • Restore point deletion: backup files, objects or whole repositories are deleted directly.
  • Job disabling or deletion: jobs are switched off, deleted or pointed at the wrong target, so no new restore points are created while existing ones age out.
  • Key changes: an encryption key is changed or deleted so existing copies cannot be read, or new access keys are created for later use.
  • Catalog changes: entries are removed from the backup catalog, so data that still exists cannot be found for a restore.

Why does tampering stay hidden?

Most of these methods use the backup system's own routine functions. Every job still finishes, every dashboard stays green, and the damage shows only on the day a restore is attempted. None of them needs malware, only the backup administrator's login, which is why tampering usually follows credential theft. In the ransomware kill chain it comes before encryption, because a victim with working backups has less reason to pay.

Which signal exposes it?

The age of the oldest usable restore point. In a healthy system it moves forward one day each day, in step with retention. If it jumps forward while the console looks normal, retention has been shortened, and that change is easy to graph and alert on. Job success rates never show it. Sending configuration and deletion events to a central log, the practice behind breach detection, places a retention change on the same timeline as the suspicious sign-in before it.

What limits tampering at the storage layer?

Retention enforced by the storage rather than the console. With S3 Object Lock in compliance mode, a stolen backup login can still change console settings but cannot make the storage release locked versions early. The request is refused, and the refusal is itself a log entry. How much a single login can change is its administrative blast radius.

Frequently asked questions

Is tampering the same as deleting backups?

Deletion is one form. Most tampering changes the rules, such as retention or jobs, so the system removes copies or stops creating them on its own.

Can an immutable backup be tampered with?

Locked restore points cannot be altered or have their retention shortened. Jobs and schedules around them can still be changed, so new backups can be stopped while old ones stay safe.

What does an alert on tampering watch?

Retention changes, disabled or deleted jobs, new access keys, encryption key changes and sudden jumps in the age of the oldest usable restore point.