Backup Destruction
0 confirmed incidents.
VERIS: malware:Destroy dataMITRE ATT&CK: T1561 (Disk Wipe)T1490 (Inhibit System Recovery)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Backup destruction is the deliberate destruction or corruption of an organization's backup copies, usually carried out alongside a ransomware attack so the victim cannot simply restore from backup and is pushed toward paying instead. It maps to two MITRE ATT&CK techniques: T1561 (Disk Wipe) and T1490 (Inhibit System Recovery). Because backup destruction is rarely the sole cause of exposure -- the intrusion that reached the backups is what actually exposes personal data -- an incident classified this way typically also involves separate exfiltration or ransomware activity recorded alongside it.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Backup Destruction on Breach Census?
0 confirmed incidents are currently classified as Backup Destruction.
Which MITRE ATT&CK techniques does the Backup Destruction classification cover?
This classification maps to MITRE ATT&CK techniques T1561 (Disk Wipe), T1490 (Inhibit System Recovery).
What counts as a confirmed incident for the Backup Destruction classification?
An incident counts here once it carries the Backup Destruction attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.