A nit, but it is important to differentiate between offsite and offline backups. VFEmail did have offsite backups, but they were online, and the attacker reform

A nit, but it is important to differentiate between offsite and offline backups. VFEmail did have offsite backups, but they were online, and the attacker reformatted those disks as well. offsite: prevents against physical damage to a single site. offline: prevents against network-based attacks. You should have offline backups and offsite backups, which can be the same, or separate. Eg backup to disk/tape, and send it somewhere for storage, or backup to disk/tape kept offline locally, combined with online backups to a server offsite.