My backup job suddenly takes twice as long or much shorter than last week
A sudden change in backup size or duration is an early warning. Too much change = possible ransomware encryption, too little = data leaking away or source is empty.
Try this first
- 1Compare the delta percentage or change rate to previous weeks. Backup tools usually show how much data changed.
- 2Sudden spike (e.g. 30% data changed on a quiet share): possibly ransomware encryption. Stop further backups so you do not overwrite good versions. Go to the ransomware runbook.
- 3Sudden drop: maybe a share or disk is no longer mounted. Check the source; is everything that should run actually running?
- 4Set a threshold above and below which you get an alert. Veeam, Acronis, Synology all have options for this.
When to bring us in
Unexpected change rates are a red flag. Call us before you trigger 'next run'; we can check together whether it is a valid business change or an attack symptom.
See also
- We have backups but we do not know if they workA backup that cannot be restored is not a backup. Testing matters as much as taking the backup.
- Suspected ransomware: what to do RIGHT NOWThe first 30 minutes are critical. One wrong move spreads the damage. Read before acting.
- Someone accidentally deleted an important folderUsually fine to recover. The trick: do not save anything new on that drive until you know how.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.