Only 39% get their data back after ransomware: how to make backups in Mexico that actually restore

Three numbers came out of Mexico this week. Ransomware grew 38% in the last year, as reported by Fortuna y Poder on September 9. Mexico takes 18% of the attacks in Latin America, second in the region. And only 39% of attacked organizations got their data back, Computer Weekly reported on September 8.

If you run a plant or a sales office in Mexico from abroad, HQ will not ask whether the site has backups, but whether they restore.

ProcessBi

A backup nobody has restored does not exist

Ransomware encrypts your files, meaning it makes them unreadable, and asks for money for the key. Paying guarantees nothing. Restoring does.

We have walked into offices in Mexico where «there was a backup»: a USB drive plugged into the server. Ransomware encrypted it with everything else. In another, the nightly job had run for two years, but the disk filled up at month eight and nobody read the alert.

In our experience, the gap between the 39% and the rest is rarely budget. It is having restored the backup once, fully, with a stopwatch running.

The 3-2-1 rule, plus one copy nobody can delete

Three copies of your data: the one you work on plus two backups. Two different media, say the server disk and a NAS, a box of disks on the network. One copy away from the site.

Add an immutable or offline copy. Immutable means nobody can delete or alter it for a set period, not even an attacker with the admin password. Offline is simpler: a disk unplugged when the job ends.

Copy	Where it lives	What it saves you from
The one you use	Server and workstations	Nothing, it is the original
Local backup	NAS or disk in another room	Accidental deletes, failed disk
Off-site, immutable	Cloud or disconnected disk	Ransomware, fire, theft

Cloud backup or local backup for your Mexico site

	Local (NAS or disk)	Cloud
Restore one file	Minutes, on the LAN	Depends on the internet link
Survives ransomware	Only if offline or with snapshots	Yes, if immutable with separate credentials
Fire, theft, flood	No	Yes
Visible from HQ	Only through the local team	Yes, with its own dashboard

A site with its own server uses both: local for the file sales deleted, cloud for the bad day. Microsoft 365 mailboxes and SharePoint still need a separate backup. Microsoft does not do it for you.

RPO and RTO in plain words

RPO, recovery point objective, is how much work you accept losing. Nightly backups mean one day: an attack at 4 pm takes today with it. RTO, recovery time objective, is how long until the site runs again. Almost nobody has measured it.

For a store with a point of sale, an RTO of two days means two days closed. Líder Empresarial reported that an outage can cost a company in Mexico up to 10 million dollars. Your number will differ, but the math is the same: hours down times what each hour is worth.

The monthly restore test

1. Pick a file, a folder and, once a quarter, a full server.
2. Restore it somewhere else, never over the original.
3. Open it. Have the accountant check the totals.
4. Time it. That is your real RTO.
5. Keep dated evidence.

Swapping the offline disk or rebuilding a server needs hands on site, which is what IT smart hands in Mexico cover. At ProcessBi the restore test is part of the IT support plan, with right-sized servers or cloud backup and a one-page continuity plan: what gets restored first and who calls whom. Invoicing in MXN or USD.

Let’s talk

What about your Mexico operation?

If nobody can tell you the date of the last successful restore, the answer is «never». Start there: it is the cheapest question and the one that changes the most.

Tell us how the site backs up today and we will tell you, at no cost, what would survive an attack.

Book your backup review — we reply the same business day.