At a high level the way to defeat this kind of attack is to require more people to be involved. Large conspiracies most often fail. In this case that could me

At a high level the way to defeat this kind of attack is to require more people to be involved. Large conspiracies most often fail. In this case that could mean having 3 USB disks, each with their own 'owner'. The owner of each disk would be responsible for making the backups and storing them in a place only they can access. This is also lesson on how to let someone go. They say it's possible that a former employee may have done the deed. When letting someone go on bad (and even good) terms you need to have IT disable all of their accounts as soon as possible, preferably while they are in-process of being fired.