Object First Research Reveals Less Than Half of UK Public Sector Backs Up Critical Systems Daily

National Health Service, councils, and schools fall short on immutability, Zero Trust, and incident response

LONDON — June 5 — Object First, the creator of Ootbi (Out-of-the-Box-Immutability), the ransomware-proof backup storage appliance purpose-built for Veeam, has revealed through new Freedom of Information (FoI) data that less than half of UK public sector organisations back up critical systems daily. This is despite more than 28,000 data breaches reported across National Health Service (NHS) trusts, local councils, and educational institutions over the past three years, exposing personal, health, and financial data. 

The findings come as ransomware attacks have led to an estimated $1 billion USD flowing to ransomware criminals globally. The National Crime Agency (NCA) considers ransomware to be the largest cybercrime and cybersecurity threat and a risk to the UK’s national security. Yet, with 96% of ransomware incidents now targeting backups, insufficient backup strategies – particularly those lacking immutability and Zero Trust – leave the public sector and citizens dangerously vulnerable.  

Object First conducted the FoI campaign to assess how public sector organisations secure critical systems against cyber threats. 150 organisations were approached, and the responses pointed to severe vulnerabilities in data backup, immutability, and Zero Trust security practices. Two NHS Trusts confirmed they were impacted by ransomware attacks.

Key findings: 

• Nearly 30,000 Breaches Reported in Three Years: In the past 36 months, 28,696 breaches were reported across the UK public sector.

• Public Sector Backup Gaps Leave Critical Systems at Risk: Only 47% of UK public sector organisations back up critical systems at least daily. 

• Infrequent Backups Across NHS, Councils and Education: More than 60% of NHS trusts, 44% of local councils, and 42% of educational institutions back up their data less than once a day.

• Immutability Missing from Most Backup Strategies: 57% of public sector organisations don’t use immutable backup storage – which leaves data vulnerable to encryption, alteration, or deletion during an attack. NHS trusts are the furthest behind, 65% don’t store immutable backups, followed by 57% of education institutions and 51% of local councils.

• Zero Trust Lacking in More Than Half of Backup Environments: 54% of all respondents fail to apply Zero Trust principles to backup strategies. 

• Incident Response Plans Still Not the Norm: Only 50% of the organisations surveyed confirmed that they have an incident response plan in place – despite the UK’s Information Commissioner’s Office guidance to have one alongside regular testing.

“Public sector organisations do vital work, often under immense resource constraints, but the scale of these data protection gaps is deeply concerning. When fewer than half of government organisations back up critical systems daily, and even fewer have implemented immutability or Zero Trust, the risks from ransomware can be catastrophic,” said Andy French, Director of Product Marketing at Object First. “With ransomware attacks increasingly targeting backups, public sector organisations must strengthen their security strategies. The UK government may consider new proposals to strengthen defences, but action is needed now. Our recent research with Enterprise Strategy Group found that 81% of IT professionals see immutable backup storage built on Zero Trust principles as the best defence against ransomware. That consensus sends a clear message that resilience starts with storage. This doesn’t require complex, expensive deployments. Just secure, simple, and powerful solutions that provide instant immutability.”