According to Veeam 2025 Ransomware Trends, 89% of organizations hit by ransomware reported that attackers attempted to access their backup repositories, with 34% of these repositories being modified or deleted. Furthermore, ESA Pro reports that approximately 20% of business attacks in 2025 were related to ransomware.
To mitigate these risks, cloud object storage offers the Object Lock mechanism based on the WORM (write once, read many) model. This feature prevents objects from being deleted or overwritten until a specified retention period expires, even if an attacker gains access to privileged administrative credentials.
Users can choose between two primary modes: Governance, which allows users with special permissions to remove the lock, and Compliance, which prevents anyone, including the project owner, from modifying or deleting data until the retention period ends. Additionally, Legal Hold provides indefinite storage for audit or legal purposes.
These settings must be configured when creating a bucket, as they cannot be changed later. The system allows for up to five backup buckets per project. While immutable backups protect against deletion, they do not impact recovery time, which depends on the chain of incremental backups and the volume of data being restored.
In the VK Cloud environment, immutable backups are currently available for virtual machines and their disks, but not for managed databases. The service manages the creation of buckets automatically based on the selected retention policy, ensuring that backup storage remains isolated from the production environment.
