Key Takeaways
- Recent breaches at One Medical and Mount Royal University show attackers are increasingly targeting storage and backup systems, not just endpoints or networks.
- Storage now holds the organization’s most valuable data—including patient records, intellectual property, and recovery copies—making it a prime attack surface.
- Periodic audits and manual reviews are insufficient; continuous hardening is required to keep pace with rapidly evolving threats.
- AI is shrinking the window between vulnerability discovery and exploitation, accelerating the risk to misconfigured storage.
- Strong backups alone do not equal cyber resilience; backup infrastructure must be secured independently and monitored for drift.
- Organizations should treat storage as part of the attack surface, continuously assess configuration drift, secure backup systems, reduce remediation time, and align storage security with broader cyber‑resilience programs.
- Joint ownership by security and IT teams, integrated into risk and ransomware preparedness plans, is essential for lasting protection.
The Recent Attacks Expose a Storage Blind Spot
High‑profile incidents at One Medical and Mount Royal University revealed that threat actors successfully penetrated archived patient record repositories and file storage systems, stealing data and even deleting backups to impede recovery. Although the tactics differed, both attacks underscored a common weakness: organizations continue to fortify endpoints, identities, clouds, and networks while leaving storage and backup infrastructure largely unexamined. These events serve as a stark reminder that the systems tasked with safeguarding an organization’s most critical asset—its data—remain a significant gap in many cyber‑defense strategies.
Why Storage Has Become a Prime Target
Modern storage environments are far from passive archives; they host sensitive customer information, proprietary intellectual property, compliance records, and the very backups needed to survive ransomware attacks. Because they consolidate the data that drives business operations and recovery, adversaries view storage repositories as lucrative targets. Misconfigurations, excessive permissions, outdated firmware, or exposed management interfaces can provide attackers with a direct line to the crown jewels, often long before any ransomware payload is deployed.
The Limitations of Periodic Security Reviews
Despite the growing importance of storage, many organizations still rely on quarterly or annual audits, manual configuration checks, and ad‑hoc reviews to gauge security posture. Such intermittent assessments provide only a snapshot of risk at a single point in time. In a dynamic IT landscape where volumes are provisioned, firmware updated, replication policies altered, and administrator privileges shifted daily, a point‑in‑time review quickly becomes outdated, leaving exploitable gaps unnoticed for weeks or months.
AI Accelerates the Threat Landscape
The rapid adoption of artificial intelligence is reshaping both offensive and defensive capabilities. Defenders use AI to improve detection, speed investigations, and automate remediation, while attackers leverage AI to scan for weaknesses, prioritize exploits, and shrink the time between vulnerability discovery and weaponization. As the cost and complexity of developing attacks fall, the window during which a storage misconfiguration can remain hidden is narrowing dramatically. Consequently, reliance on infrequent assessments is no longer viable; continuous hardening has become a necessity to stay ahead of AI‑accelerated threats.
Backups Alone Do Not Guarantee Resilience
A common misconception is that a robust backup strategy equals cyber resilience. In reality, backups are a recovery mechanism, not a security control. If backup repositories, management interfaces, snapshots, or replication targets are inadequately protected, attackers can compromise them long before ransomware is triggered—sometimes even deleting or encrypting backups to prevent restoration, as seen in the UnitedHealth Change Healthcare incident. Organizations may only uncover these deficiencies after an incident, at which point recovery becomes far more complex, costly, and uncertain.
From Visibility to Continuous Hardening
Many IT teams already maintain an inventory of their storage assets; the challenge lies in preserving secure configurations amid constant change. Every new volume, share, firmware update, policy adjustment, or privilege grant introduces potential risk. A one‑time assessment cannot guarantee that security controls remain aligned with vendor best practices, industry frameworks, or internal policies over time. Continuous hardening—ongoing validation, automated drift detection, and timely remediation—must become a core component of any cyber‑resilience program, ensuring that storage defenses stay effective as the environment evolves.
Five Practical Steps Organizations Can Take Today
- Treat Storage as Part of Your Attack Surface – Include storage and backup systems in risk and exposure management initiatives alongside servers, endpoints, cloud resources, and network devices. If attackers view storage as a target, defenders must do the same.
- Continuously Assess Configuration Drift – Deploy tools and processes that constantly evaluate storage security configurations against vendor recommendations, security frameworks (e.g., NIST, CIS), and internal standards, rather than relying solely on annual reviews.
- Secure Backup Infrastructure Independently – Apply dedicated security controls, monitoring, and hardening practices to backup systems, assuming adversaries will attempt to reach these repositories and designing defenses accordingly.
- Reduce Time‑to‑Remediation – Prioritize shrinking the interval between detecting a security issue and implementing a fix. The longer an exposure remains unaddressed, the greater the opportunity for attackers to exploit it.
- Align Storage Security With Cyber‑Resilience Programs – Assign joint ownership of storage security to security and IT teams, integrating it into risk management, ransomware preparedness, compliance efforts, and overall resilience planning.
The Future of Cyber Resilience Starts With Data Infrastructure
The cybersecurity industry has made substantial strides in gaining visibility across networks, identities, cloud services, and endpoints. Yet the attacks on One Medical and Mount Royal University demonstrate that visibility alone is insufficient when the systems holding an organization’s most critical data remain a blind spot. As AI continues to accelerate the speed at which threats emerge and evolve, organizations must shift from periodic assessment to a mindset of continuous hardening. Only by ensuring that storage and backup systems are secured every single day can true cyber resilience be achieved—because protecting data means protecting the very infrastructure that stores and safeguards it.