# Can ransomware reach the files we keep in the cloud?

Yes, mainly through the devices and accounts that sync or administer them. When ransomware encrypts files on a laptop whose folders are synchronised with cloud storage, the sync client faithfully uploads the encrypted versions, so the cloud copies change too. An attacker with a stolen admin account can delete or encrypt data directly in the service, remove backups and versions, or exfiltrate everything first and threaten to publish it. What helps: keep file versioning switched on with enough history, and know how to roll a whole folder back at once; protect admin accounts with phishing-resistant multi-factor authentication and separate them from daily accounts; enable deletion protection or retention locks where the service offers them; keep an independent backup that the same admins cannot remove; and limit sync to the folders people need. Watch the steps that come before encryption, because they are where you can still intervene: on every plan, NetSenX detects beaconing, scanning, lateral movement and unusual outbound volume, including large uploads to cloud storage. It does not see actions inside the cloud service's admin console.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/can-ransomware-reach-our-cloud-files

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [Is our SaaS data backed up by the provider?](https://netsenx.com/en/faq/is-our-saas-data-backed-up-by-the-provider)
- [How do we secure our Microsoft 365 or Google Workspace accounts?](https://netsenx.com/en/faq/how-to-secure-microsoft-365-and-google-workspace-accounts)
- [What is OAuth consent phishing?](https://netsenx.com/en/faq/what-is-oauth-consent-phishing)
- [Which cloud and SaaS logs should we switch on and keep?](https://netsenx.com/en/faq/what-logs-should-we-keep-for-cloud-and-saas)
- [What happens if cloud access keys leak, for example on GitHub?](https://netsenx.com/en/faq/what-happens-if-cloud-access-keys-leak)