Most ransomware conversations focus on keeping attackers out. That work matters, but it isn't what decides how an incident ends. When prevention fails, and at some point it will, the outcome comes down to one question: how fast can you get back to work without paying?
For healthcare and manufacturing, the answer is measured in patient care and production output. And the latest data shows a widening gap between organizations that have engineered recovery and those that are hoping their backups will hold.
The good news: recovery is improving
Sophos's State of Ransomware in Healthcare 2025 found that 58% of healthcare organizations recovered within a week, more than double the 21% reported the year before. In manufacturing, half of organizations stopped attacks before data could be encrypted, up from 24% the prior year, and the average cost to recover (excluding any ransom) fell 24% to $1.3 million.
Those improvements didn't happen by accident. They reflect organizations that treated recovery as a capability to design, test, and maintain, not an insurance policy they'd never need.
The bad news: attackers go after backups first
Ransomware operators understand that working backups take away their leverage, so they hunt for them early. In Sophos's healthcare research, 95% of organizations hit by ransomware said attackers tried to compromise their backups during the attack. The organizations whose backups were compromised were more than twice as likely to pay the ransom, 63% compared to 27%.
A backup that sits on the same network, uses the same administrator credentials, or has never been restored under pressure is a backup an attacker can find and destroy.
Data theft changes the math
There's a second shift worth noting. In manufacturing, extortion-only attacks, where data is stolen but nothing is encrypted, jumped from 3% to 10%. And more than half of the manufacturers whose data was encrypted still paid a ransom.
Backups solve encryption. They don't solve exposure. That's why recovery planning has to sit alongside early detection, not replace it.
Backups aren't a recovery plan
Here's a scenario that catches many organizations off guard. The file servers are restored. The applications are restored. But nobody can log in, because Active Directory was encrypted too, and every system depends on it to authenticate.
Attackers know this. Sophos found that intruders reach Active Directory in a median of just 3.4 hours after initial access. If your recovery plan doesn't start with identity, it doesn't start.
What recoverable looks like
Organizations that recover in days rather than weeks tend to share a few practices.
Isolated, immutable copies. At least one copy of critical data should be offline or immutable, stored separately from production credentials, so it can't be deleted or encrypted from inside a compromised network.
An identity-first recovery plan. Restoring Active Directory to a known-clean state is the first step in bringing everything else back. That takes purpose-built tooling and a documented process, not a domain controller snapshot and good intentions.
Recovery order tied to the business. Electronic health records, clinical scheduling, and pharmacy systems in healthcare. MES, ERP, and line control in manufacturing. Teams should know in advance what comes back first, second, and third.
Tested restores with measured times. A backup that has never been restored is an assumption. Regular restore tests show whether recovery time objectives are realistic or wishful.
Clean restoration. Restoring from a backup that already contains the attacker's foothold just restarts the incident. Recovery should include verifying that what comes back is clean.
Sector realities
Healthcare organizations already have a regulatory head start. The HIPAA Security Rule requires a contingency plan that includes data backup, disaster recovery, and emergency mode operations. The challenge is that many of those plans were written for a fire or flood, not for an adversary actively trying to destroy the backups.
Manufacturing faces a different pressure: every hour offline is lost output, missed shipments, and strained customer relationships. Recovery plans need to account for OT and plant-floor systems that can't simply be reimaged from a cloud console.
How Tec-Refresh helps
Tec-Refresh's backup and disaster recovery services are built around the attacker's playbook. Our infrastructure team designs and manages isolated, immutable backup architecture, monitors backup health daily, and runs scheduled restore tests so recovery times are proven before an incident, not discovered during one.
For the identity layer, we work with Semperis to deliver Active Directory forest recovery that restores AD to a clean, known-good state quickly, so the rest of your environment has something trustworthy to authenticate against. If you're not sure how exposed your AD is today, an Active Directory Risk Assessment is a good place to start.
The question worth asking this month
Cybersecurity Awareness Month is a good time for one honest exercise. Ask your team: if everything were encrypted tonight, how long until the first patient record or the first production line comes back?
If nobody can answer with a number they've tested, that's the gap to close.