Many of our clients ask the same question: “Is backing up to the cloud safe?” It’s a fair thing to wonder, especially for a business. In this article I’ll walk through the real risks of cloud storage and share a few experiences we’ve had firsthand with cloud security and reliability.

A cloud RAID failure that nearly cost a company everything

A few years ago we got a call from a cloud solution provider whose RAID array, the one storing their clients’ databases, had failed. They were facing several incoming lawsuits and had exactly one chance to make them go away: get their data back.

They had researched every company advertising data recovery in the city, obsessively. When they called, I was put on speaker in the middle of their board meeting. I told them this was our specialty, and my first instruction was to power the system down and do nothing further to it. They asked for references, and I said, “Go to our site, choose any testimonials you’d like, and I’ll connect you.” They said they’d look into it and call me back. Three minutes later, the job was ours.

We recovered their data and the lawsuits went away. But ever since, I’ve had a hard time putting much faith in cloud security and reliability.

The ransomware attack that hit 400 dental practices

Then came Monday, August 26, 2019. I got a call from a dentist I’d recovered data for in the past, and he was in a panic. “Don, I may need your services again — you won’t believe what happened.”

Here is the part worth understanding before the rest of it. His practice had bought DDS Safe, an online backup service sold to dental offices by a Wisconsin company called The Digital Dental Record. The company whose systems were actually encrypted that morning was PerCSoft, the cloud management provider sitting behind it. My dentist had never heard the name PerCSoft in his life. He had bought a backup service from one company, and the thing that failed was a second company he did not know existed.

The ransomware was REvil, also called Sodinokibi, one of the more advanced families active at the time. The Wisconsin Dental Association put the number of encrypted practices at roughly 400.

I tried to calm him down, but there wasn’t much anyone could do in that moment. He kept repeating, “I know, but it’s my business.” And that was the hard part: there was nothing to recover locally. Every one of those practices was down because a single provider had been compromised.

Several outlets reported that a ransom was paid, though the companies involved said only that they had worked with a third party and obtained a decryptor. And the decryptor did not work for everyone. Some offices had files back within days. Others waited for a second version. It’s impossible to say what the lost time and locked records were truly worth to those businesses.

Reported by Krebs on Security, BleepingComputer and HIPAA Journal, August–September 2019.

The second copy you never asked for

There is one more place your data ends up in a cloud, and almost nobody counts it.

A mail-in data recovery operation typically finishes a case by uploading your recovered files to a cloud account and emailing you a download link. The speed of that handoff is what gets advertised. Files back the same day. No waiting for a drive in the mail.

Count the exposures in that arrangement. Your only copy travels through a courier system nobody watches. It is handled by technicians you never meet, in a building you have never seen. And then a second complete copy of everything is pushed onto a third party’s servers, under a retention policy you did not choose and cannot audit, reachable by a link sitting in your email.

That is three places your data exists, and you control none of them.

Ask the question that follows from it. How long does that copy stay there? Who at that company can reach it? Is the storage account theirs, or is it a consumer account somebody set up? And when they tell you it has been deleted, what are they showing you?

A company can call that secure. It cannot show you the copy being deleted.

Here it works the other way around. Your recovered data is handed back in person, on media. You verify the files with the engineer before you pay, which is not something a distant operation declines to offer — it is something it structurally cannot offer. And our copy is securely erased two weeks after completion unless you arrange otherwise in writing.

So — is the cloud safe?

Here’s what I tell my clients: the cloud is perfectly fine for photos and non-confidential files. But I personally wouldn’t trust it with my business, or with anything sensitive — HIPAA-covered records, financial information, or client data.

Your data could be sitting on a server in another country, and you’d never know. Cloud providers run on hard drives too, and if those aren’t monitored and maintained properly, they fail like any other drive, sometimes taking your data with them. I’ve seen more than enough evidence of what can happen, and has happened, to cloud services.

The takeaway

It isn’t “never use the cloud.” It’s this: don’t rely on any single copy of important data, cloud included. Keep your own local backup of anything you can’t afford to lose, ideally on more than one drive, and know exactly where your confidential data lives and who has access to it. The cloud can be part of a good backup plan. It just shouldn’t be your only plan.

And when a recovery is finished, you should know where every copy went, who could reach it, and when it stopped existing. Here, you hand us one drive, you watch the files come back, and your data is securely purged two weeks after completion.