I worked for a company that got crypto-locked. We had backups. We had tested that representative backups and restores worked; do you test restore every backup you take? We did not test that restores worked across all affected machines concurrently in a reasonable amount of time.

We did end up restoring some large percentage of machines from backup, eventually, then after retrieving/reviewing data we trashed those machines and rebuilt them. We also ended up paying - some of the backups didn't work, and some were taking so long to restore it didn't make sense to wait for them - and we rebuilt those as well.

At least for us, we probably could have done a better job with testing backups. The behavior we saw with individual test restores was not the same as the what happened with mass restores, and we were surprised by that. Also, beyond just restoring from backup, we spent a lot of time rebuilding machines; if you get compromised, your backup might be clean, but the restored state is probably ready to be compromised again. I don't remember how long it was before our security people said they figured out how we got compromised in the first place.

Read the article it’s right in there, I assure you. It was even quoted in the HN comments.

Backups are a cost center...

Backups get encrypted too