Ransomware Doesn't Care That Those Are Your Kids' Baby Photos

On the afternoon of Friday, May 12, 2017, receptionists at hospitals across England watched their computer screens go red. A window appeared: your files have been encrypted; send $300 in bitcoin; the price doubles in three days. Surgeries were cancelled. Ambulances were diverted.

The attack was called WannaCry. Within a day it had reached roughly 200,000 computers in 150 countries. And it taught a lesson that the security industry has been repeating ever since, because nobody wants to hear it: to ransomware, your data is not precious. It's inventory.

To encryption, everything is bytes

This is the first thing to understand, and it's the thing that makes ransomware different from every earlier kind of computer crime. A thief steals what has value and leaves the rest. Ransomware encrypts indiscriminately — baby photos, tax returns, wedding videos, a company's shipping manifests — because the encryption doesn't need to know what anything is. It walks the file system, finds files by extension, and scrambles them with military-grade cryptography that no one is going to break.

The cruelty is structural, not personal. Nobody targeted the hospital; you were encrypted because you were reachable — an unpatched machine on a network, running a vulnerable version of the SMB file-sharing protocol. WannaCry spread using EternalBlue, an exploit developed by the NSA and leaked by a group called the Shadow Brokers a month earlier. Your memories were collateral in someone else's weapons program.

Six weeks later came NotPetya — disguised as ransomware, designed as a wiper — entering through a compromised update for M.E.Doc, a Ukrainian tax accounting program, then moving laterally through corporate networks on the same stolen exploits, encrypting master boot records so machines couldn't even start. It didn't matter what the files were. It mattered that they were there.

The $300 million baby photo

The most instructive victim of NotPetya was Maersk, the Danish shipping giant — the company that moves roughly a fifth of the world's seaborne freight. On the morning of June 27, 2017, Maersk's staff watched their screens go black, one after another, across offices worldwide. Phones were disconnected. The booking systems that schedule container ships went down. For ten days, the company ran a significant part of its global operation on paper, WhatsApp, and shouted instructions.

The recovery was one of the largest IT rebuilds ever attempted under fire: about 4,000 servers, 45,000 PCs, and 2,500 applications reinstalled from scratch. The final bill was estimated at $200 to $300 million. FedEx's European arm, TNT Express, lost around $300 million to the same attack. The pharmaceutical company Merck lost roughly $670 million.

Here is the detail that matters for this story: Maersk was saved, in part, by luck and disconnection. A single domain controller in Ghana — offline at the critical moment because of a local power outage — survived when every connected machine was encrypted. That one unreachable server became the seed from which the company's entire network identity was rebuilt. The copy that lived was the copy the attackers couldn't touch — not the fanciest backup system, just the one that happened to be unplugged.

Your backup is on the list, too

Most people's backup strategy, if they have one, looks like this: an external drive plugged into the computer, or a folder that syncs to the cloud. Both are reachable. And reachable is exactly what ransomware hunts.

Modern ransomware doesn't just encrypt your documents. It enumerates network shares. It encrypts the USB drive sitting on your desk. It deletes Windows shadow copies — the system's own restore points — before you can use them. Some variants sit quietly for weeks, slowly encrypting cloud-synced folders so corrupted versions propagate to every device and poison the version history. Your backup, your sync, your "it's fine, it's in the cloud" — all of it is on the same network, behind the same credentials, one lateral move away.

This is why security people draw a hard line between a backup and an air-gapped backup. A backup is a copy. An air-gapped backup is a copy that cannot be reached — not by you in a moment of convenience, and therefore not by an attacker in a moment of opportunity. The inconvenience is the protection. Every shortcut that makes a backup easier to reach makes it easier to destroy.

The physics of "can't get there from here"

There is a reason the industry's gold standard for ransomware recovery has barely changed in thirty years: an offline copy, in a separate location, tested by restore. Tape libraries. Detached hard drives. Write-once media. The technology is deliberately unglamorous, because glamour is attack surface.

Consider what the attacker would have to do to destroy a properly air-gapped copy. They can't reach it over the network, because it isn't on one. They can't encrypt it with stolen credentials, because no credential unlocks a drive sitting in a sealed bag on a shelf. They would have to physically find the building, get past the door, and lay hands on the media. That converts a scalable software attack — one exploit, 200,000 victims — into a burglary. Burglaries don't scale. That's the whole game: ransomware is an economy of scale, and the air gap breaks the economy.

Epicurus had a word for the state this produces: ataraxia, usually translated as tranquility — the calm that comes not from believing nothing bad will happen, but from arranging things so that the bad thing, if it happens, can't reach what matters. Most security products sell you the first kind of calm: trust us, we're watching. An offline copy sells you the second: it doesn't matter who's watching, because there's nothing to see.

The unglamorous discipline

None of this is new. The 3-2-1 rule — three copies, two media types, one offsite and offline — predates WannaCry by decades. What the ransomware era changed is the cost of skipping the last step. In 2010, skipping your offline copy meant risking a house fire or a dead drive. In 2017 and after, it means risking an adversary who actively hunts your copies.

And the last step is still the one nobody does, because it's the only one that resists automation. You can't air-gap with a checkbox. Someone has to unplug the drive, take it somewhere, power it on twice a year, verify the data, and put it back. It's janitorial work — numbering, sealing, logging, checking — done on a schedule, forever.

That's precisely why it fails as a personal habit and succeeds as a profession. The people who are best at it are the ones for whom it isn't a chore squeezed between other chores, but the entire job: receive the media, seal it with a numbered band, photograph the seal, store the copies in two places, inspect the seals on schedule, log, repeat — and power a drive on to verify it only when its owner asks, in writing. Boring, documented, and — when the screens go red on a Friday afternoon — the difference between an interruption and an ending.

Your baby photos are not safer because ransomware has a heart. They're safer when there's simply no path from the attacker to the drive. No path, no ransom. That's not a product pitch. It's physics.

Everkeep provides offline custody for encrypted drives you own and encrypt yourself: numbered seals, photo records, two copies in two separate locations, seal inspections on schedule — and power-on verification only on your written request. $199/year per device slot.