Can ransomware reach the files we keep in the cloud?
Yes, mainly through the devices and accounts that sync or administer them. When ransomware encrypts files on a laptop whose folders are synchronised with cloud storage, the sync client faithfully uploads the encrypted versions, so the cloud copies change too. An attacker with a stolen admin account can delete or encrypt data directly in the service, remove backups and versions, or exfiltrate everything first and threaten to publish it. What helps: keep file versioning switched on with enough history, and know how to roll a whole folder back at once; protect admin accounts with phishing-resistant multi-factor authentication and separate them from daily accounts; enable deletion protection or retention locks where the service offers them; keep an independent backup that the same admins cannot remove; and limit sync to the folders people need. Watch the steps that come before encryption, because they are where you can still intervene: on every plan, NetSenX detects beaconing, scanning, lateral movement and unusual outbound volume, including large uploads to cloud storage. It does not see actions inside the cloud service's admin console.