Would Your Law Firm's Backups Survive a Ransomware Attack?

Your law firm's backups will survive a ransomware attack only if three things are true: attackers can't alter or delete them, someone checks them every day, and they've actually been restored recently. A backup that's reachable from your network, or that no one has tested, can fail at exactly the moment you need it.

At Tomorrow's Technology Today, every client gets immutable backup as standard, and every backup gets a full restore test every other week. Managed IT runs $200 to $350 per user per month, with our Gold plan starting at $200, and backup is part of it.

The 5-Question Backup Self-Check

1. Is there a copy attackers can't change or delete? Ransomware often goes after backups first. Immutable backups can't be altered or deleted, even by someone with access to your network.
2. When was your last full restore test? If nobody knows, the honest answer is "never." A backup that completes isn't the same as a backup that restores.
3. Who checks your backups every day? Failures happen quietly. Someone should be looking, and acting, every business day.
4. How long would a full restore take? If you don't have an estimate, you don't have a recovery plan.
5. Are your Microsoft 365 files backed up separately? Email, OneDrive and SharePoint hold much of a modern firm's client data, and they need their own backup.

If you answered "I don't know" to two or more, your backups may not be the safety net you think. Here are 4 expensive backup assumptions to avoid.

How We Protect a Firm's Backups

• Immutable backup as standard, for every client.
• Microsoft 365 backup for every client, plus server and critical-workstation backups for firms that have them.
• Captured twice a day. Each capture is kept for 90 days, and a month-end copy is kept indefinitely after that.
• Checked every business morning. An engineer reviews backup status, and any failure becomes a support ticket that day.
• Escalated fast. An error that stays open for 2 consecutive days triggers an escalated investigation directly with the backup vendor.
• Cross-checked independently. Backup status is verified against a separate, third-party monitoring system.
• Restore-tested every other week. Every backup gets a full restore test, with a screenshot of the restored system as proof.

Restore testing is the step most firms skip. Here's why restore testing matters.

A Real Client Example: Back by Monday Morning

The problem: Over a weekend, our security operations center called: it was seeing intrusive activity on one of a manufacturing client's virtual servers. The team locked the server down immediately, and we began investigating.

The deadline: Monday morning, when employees walked in. The goal was for no one to notice anything had happened.

The solution: We powered off the firm's physical server, put an emergency server in place, and restored the firm's systems from backup.

The result: Everything was back up and running within 48 hours. When employees came in Monday morning, they didn't feel a thing. Everything worked just as it had when they left on Friday.

It's not a law firm, but the lesson is the same: the restore worked because it had been tested before it was needed.

Why It Matters More for a Law Firm

For a law firm, a ransomware attack is more than downtime. Client files may be exposed, and Ohio Rule of Professional Conduct 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized access to client information. Protected, tested backups are part of meeting that standard. If your files still live on an aging office server, see how a small law firm moves off its office server or NAS.

Why Law Firms Work With Tomorrow's Technology Today

• More than 20 years in business, headquartered in St. Henry, Ohio, serving firms across Northwest Ohio and Northeast Indiana
• Woman-owned and woman-led
• Every technician is security-trained to CJIS standards and background-checked
• Owner Lisa Niekamp-Urwin wrote Sitting Duck: Why Your Business Is a Cybercriminal's Ideal Target, a #1 Amazon Best Seller, and is a past president of InfraGard Toledo
• Microsoft Partner

See how we support law firms across Ohio and Indiana.

Not sure your backups would survive? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.