It's largely bad security practice. They always say "We have backups." But in reality, --The backups are not only not offsite; they are online and attackable.

It's largely bad security practice. They always say "We have backups." But in reality, --The backups are not only not offsite; they are online and attackable. --Backups are not done every day on every machine. The machines on which backups are done most rigorously are the gift shop cash registers and the machine that runs the janitorial scheduling spreadsheet. The blood test results pub/sub system was last backed up in 2019. --The restore procedure is never tested. Not rarely, never. Because it would take machines out of service for an hour. Can't have that. --Joe who runs department X drags his feet about upgrading his organization's computers and getting on the corporate backup rotation. And if department X gets taken out, the whole company shuts down. --Bob in the basement is running a research network nobody knows about, and he puts it directly on the Internet so he can run his experiments from home. And of course it contains a bridge to the corporate intranet. It's just a clusterfuck everywhere. Good people busy getting their jobs done who see security procedures as obstacles to work around. The bad guys completely understand this organizational dynamic and they exploit it for profit.