Recent cyberattacks against One Medical and Mount Royal University exposed a troubling reality: organizations continue to invest heavily in endpoint, identity, cloud, and network security while overlooking one of the most critical components of their digital infrastructure – storage and backup systems.
In the One Medical incident, attackers gained access to a storage system containing archived patient records. In the Mount Royal University attack, threat actors not only accessed and stole data from file storage repositories but also deleted stored files to hinder recovery efforts.
While the details differ, both incidents highlight the same fundamental problem: cyber resilience strategies often stop short of protecting the systems that ultimately hold an organization’s most valuable asset – its data.
The Blind Spot in Modern Cybersecurity
Over the past decade, organizations have built sophisticated security programs around preventing breaches. Identity governance, zero-trust architectures, attack surface management, vulnerability scanning, and SOC operations have become standard practice.
Yet storage and backup infrastructure often remains outside the scope of continuous security oversight.
This creates a dangerous mismatch.
Storage systems are no longer passive repositories. They contain sensitive customer information, intellectual property, backup copies, compliance records, and the data needed to recover from ransomware attacks. As a result, they have become prime targets for adversaries.
Unfortunately, many organizations still manage storage security through periodic reviews, manual audits, and configuration checks that may occur quarterly, or even annually.
In today’s threat environment, that approach is no longer sufficient.
AI Is Accelerating the Problem
The rapid adoption of AI is transforming both sides of the cybersecurity equation.
Defenders are using AI to improve detection, accelerate investigations, and automate remediation. Attackers are using AI to identify weaknesses faster, scale reconnaissance efforts, and compress the time between finding a vulnerability and exploiting it.
As the cost and complexity of attack development decreases, organizations can expect vulnerability discovery cycles to accelerate dramatically.
The implication is clear: the window between exposure and exploitation is shrinking.
A storage misconfiguration that might have remained unnoticed for months in the past could now be identified and weaponized far more quickly.
This makes continuous hardening, not periodic assessment, a necessity.
Why Backups Are No Longer Enough
Many organizations assume that a strong backup strategy equals cyber resilience.
It doesn’t.
Backups are a recovery mechanism, not a security strategy.
If storage systems, backup repositories, management interfaces, snapshots, or replication targets are misconfigured, exposed, or insufficiently protected, attackers may gain access long before ransomware is deployed.
In some cases, threat actors specifically target backup environments to prevent recovery (for example at UnitedHealth’s Change Healthcare subsidiary).
In others, they exploit excessive permissions, outdated firmware, open management interfaces, or inactive security controls within storage platforms themselves.
An organization may discover these weaknesses only after an incident occurs.
At that point, recovery becomes significantly more difficult and expensive.
Moving From Visibility to Continuous Hardening
Many IT teams already know where their storage assets reside. The challenge is maintaining secure configurations over time.
Storage environments are constantly changing:
- New volumes and file shares are created.
- Capacity is expanded.
- Firmware is updated.
- Replication policies change.
- New administrators receive access.
- Security controls are modified.
Every change introduces risk.
A one-time assessment provides only a snapshot. Cyber resilience requires continuous validation that security controls remain aligned with vendor best practices, industry frameworks, and organizational policies.
This concept of continuous hardening should become a core component of every cyber resilience program.
Five Practical Steps Organizations Can Take Today
1. Treat Storage as Part of Your Attack Surface
Storage and backup systems should be included in risk and exposure management initiatives alongside servers, endpoints, cloud resources, and network devices.
If attackers see storage as part of the attack surface, defenders must as well.
2. Continuously Assess Configuration Drift
Misconfigurations accumulate over time.
Establish processes and tools that continuously evaluate storage security configurations against vendor recommendations, security frameworks, and internal standards rather than relying solely on annual reviews.
3. Secure Backup Infrastructure Independently
Backup systems require their own security controls, monitoring, and hardening practices.
Assume attackers will attempt to reach backup repositories and design defenses accordingly.
4. Reduce Time-to-Remediation
Finding risks is only half the battle.
Organizations should focus on shrinking the time between identifying a security issue and implementing a fix. The longer an exposure remains unresolved, the greater the opportunity for attackers to exploit it.
5. Align Storage Security With Cyber Resilience Programs
Storage security should be owned jointly by security and IT teams. It must be incorporated into risk management, exposure management, ransomware preparedness, compliance initiatives, and resilience planning.
The Future of Cyber Resilience Starts With Data Infrastructure
The cybersecurity industry has spent years expanding visibility across networks, identities, cloud services, and endpoints. That progress has been essential.
But the attacks against One Medical and Mount Royal University serve as a reminder that visibility alone is not enough – and that the systems storing an organization’s most critical data cannot remain a blind spot.
As AI accelerates the speed of cyber threats, organizations need to shift their mindset from periodic assessment to continuous hardening.
Because when attackers are targeting the systems that store and protect your data, cyber resilience depends on more than just backups.
It depends on ensuring those systems remain secure every single day.
Join our LinkedIn group Information Security Community!
