--- title: "Root Cause: why breaches keep reaching backups | Firevault" description: "Backups keep getting reached because they are still on the network. Read the root causes of modern breaches and how Firevault removes the network path." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/root-cause#webpage", "url": "https://fire-vault.com/root-cause", "name": "Root Cause: why breaches keep reaching backups", "description": "Backups keep getting reached because they are still on the network. Read the root causes of modern breaches and how Firevault removes the network path.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-home.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/root-cause#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/root-cause#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Root Cause: why breaches keep reaching backups", "item": "https://fire-vault.com/root-cause" } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview Root CausesICO DataThe SolutionGet Started Understanding The Problem # The Root Cause of Every Risk Every security failure traces back to one of four root causes. Traditional security addresses symptoms . Firevault addresses causes with Offline Secure Storage®. - Cyber attacks - Human errors - Architectural flaws - Skill gaps 01 Root Causes ## Four Causes. One Architecture. Every breach, every incident, every compliance failure traces back to one of these four fundamental causes. [ ### Cyber Attacks Ransomware, breaches, and targeted intrusions Every cyber attack requires a path to your data. Traditional security tries to guard those paths. Firevault removes them entirely. When critical assets are physically disconnected, attackers have no route to reach them, regardless of how sophisticated their methods. Explore solutions 11sec Between ransomware attacks globally £3.5 million Average UK breach cost 277 days Days to detect a breach ](/root-cause/cyber-attacks) [ ### Human Errors Accidental exposure, insider threats, and mishandling People make mistakes. Even well-trained, well-intentioned employees click wrong links, share wrong files, and make configuration errors. Your architecture must limit the blast radius when mistakes happen. Firevault ensures critical data remains disconnected from default. Explore solutions 74% Of breaches involve human element £15.4M Average insider incident cost 85 Days to contain insider threat ](/root-cause/human-errors) [ ### Architectural Flaws Always-on connectivity and shared infrastructure Traditional IT architecture was designed for convenience, not security. Always-on connectivity, shared cloud infrastructure, and flat network designs create permanent attack surfaces. Firevault addresses these flaws at Layer 1, the physical layer, by removing connectivity entirely. Explore solutions 100% Of breaches need a path 62% Via third-party connections 94% Rely on cloud architecture ](/root-cause/architectural-flaws) [ ### Skill Gaps Talent shortages and operational complexity The cybersecurity skills gap exceeds 4 million professionals globally. You cannot hire your way to security. Firevault provides protection through physical design that works regardless of team size or expertise: security that does not depend on constant expert oversight. Explore solutions 4M+ Global cybersecurity skills gap 71% Report understaffed teams 67% Cannot fill security roles ](/root-cause/skill-gaps) UK Government Research ## The Economic Cost of Cyber Attacks, UK Government Research Eight UK Government research programmes (2025) quantify the cost of cyber attacks to the UK economy, from individual fraud to systemic infrastructure incidents. [Read the full DSIT/Home Office report (PDF)](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf) [ Source 437,000 Fraud victims from breaches People who became fraud victims as a direct result of data breaches in 2023 Frontier Economics for DSIT/Home Office, June 2025 ](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf)[ Source £755 million Annual cost of breach-linked fraud Annual cost of fraud resulting from data breaches in the UK Frontier Economics for DSIT/Home Office, June 2025 ](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf)[ Source 34% More likely to be defrauded Increased likelihood of fraud for individuals affected by a data breach Frontier Economics for DSIT/Home Office, June 2025 (citing Morgan & Voce 2022) ](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf) ICO Data Security Incident Trends [ Source 3,116 Incidents reported to ICO (2024) Data security incidents reported to the ICO in 2024 Frontier Economics for DSIT/Home Office, June 2025 ](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf)[ Source 33% Increase over five years Increase in ICO-reported data security incidents over five years (2019 to 2024) Frontier Economics for DSIT/Home Office, June 2025 ](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf)[ Source 612,000 UK businesses breached UK businesses that experienced a cyber breach or attack UK Government Cyber Security Breaches Survey 2025 ](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025)[ Source 3.9 million Fraud cases (year ending Sept 2024) Fraud cases in the UK (year ending September 2024), a 19% increase year-on-year Frontier Economics for DSIT/Home Office, June 2025 ](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf) UK Breach Breakdown [ Source 119% Fraud increase (credit card breach) Short-term increase in fraud probability when credit card data is breached Frontier Economics for DSIT/Home Office, June 2025 ](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf)[ Source 11% Of all fraud linked to breaches Share of all UK fraud victims whose fraud resulted from a data breach Frontier Economics for DSIT/Home Office, June 2025 ](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf)[ Source 93% Involved phishing Business breaches involving phishing attacks UK Government Cyber Security Breaches Survey 2025 ](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025)[ Source 74% Of large businesses hit Large UK businesses identifying a breach or attack UK Government Cyber Security Breaches Survey 2025 ](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025) NCA National Strategic Assessment 2025 [ Source 41% Of all crime is fraud Fraud as a share of all crime in England and Wales NCA National Strategic Assessment 2025 ](https://www.nationalcrimeagency.gov.uk/threats-2025/nsa-fraud-2025)[ Source 3.2 million Fraud victims in England and Wales People aged 16 and over in England and Wales estimated to have been fraud victims (7% of the population) NCA National Strategic Assessment 2025 ](https://www.nationalcrimeagency.gov.uk/threats-2025/nsa-fraud-2025)[ Source 67% Of fraud is cyber-enabled Of fraud reported in the UK is cyber-enabled NCA National Strategic Assessment 2025 ](https://www.nationalcrimeagency.gov.uk/threats-2025/nsa-fraud-2025)[ Source 14% Of fraud is actually reported Only 14% of frauds against individuals are reported to Action Fraud or police NCA National Strategic Assessment 2025 ](https://www.nationalcrimeagency.gov.uk/threats-2025/nsa-fraud-2025) DSIT/KPMG Economic Impact of Cyber Attacks 2025 [ Source £14.7 billion Annual cost to UK businesses Total annual cost to UK businesses of significant cyber attacks, 0.5% of GDP KPMG for DSIT, April 2025 ](https://assets.publishing.service.gov.uk/media/68b1bdd5cc8356c3c882a904/Economic_modelling_of_sector_specific_costings_of_cyber_attacks.pdf)[ Source £1B–£8.5B Annual IP theft cost to UK Annual cost to the UK economy from IP and knowledge assets theft via cyber attacks (0.04%–0.30% of GDP) Alma Economics for DSIT, July 2025 ](https://assets.publishing.service.gov.uk/media/691442809d50fc2fe8161635/Economic_Impact_of_IP_from_Cyber_Attacks_-_ALMA_ECONOMICS.pdf)[ Source £1.8 billion One-week rail cyber incident Total economic cost of a one-week systemic cyber incident to the GB rail network KPMG for DSIT, April 2025 ](https://assets.publishing.service.gov.uk/media/69144f259d50fc2fe816163a/Economic_impact_of_a_systemic_cyber_incident_rail_sector_scenario.pdf)[ Source £33.4 million Annual hospital cyber patient cost Annual patient impact from cyber attacks on major UK hospitals (estimated 3 incidents per year) KPMG for DSIT, April 2025 ](https://assets.publishing.service.gov.uk/media/6914486cb49cc44345161638/Impact_on_consumers_of_cyber_attacks.pdf)[ Source £2.56 million Average scam/fraud attack cost Average cost per scam or fraud cyber attack to a UK business KPMG for DSIT, April 2025 ](https://assets.publishing.service.gov.uk/media/68b1bdd5cc8356c3c882a904/Economic_modelling_of_sector_specific_costings_of_cyber_attacks.pdf)[ Source 16% SME sales decline after IP theft Decline in SME sales growth in the year of a cyber attack involving IP theft Alma Economics for DSIT, July 2025 ](https://assets.publishing.service.gov.uk/media/691442809d50fc2fe8161635/Economic_Impact_of_IP_from_Cyber_Attacks_-_ALMA_ECONOMICS.pdf)[ Source 150% Rise in attack cases (2022–2023) Rise in reported cyber attack cases between 2022 and 2023 Alma Economics for DSIT, July 2025 ](https://assets.publishing.service.gov.uk/media/691442809d50fc2fe8161635/Economic_Impact_of_IP_from_Cyber_Attacks_-_ALMA_ECONOMICS.pdf)[ Source Up to £231 million Banking attack consumer impact Consumer impact per cyber attack resulting in loss of access to online banking (3-day outage) KPMG for DSIT, April 2025 ](https://assets.publishing.service.gov.uk/media/6914486cb49cc44345161638/Impact_on_consumers_of_cyber_attacks.pdf) ### These are only the reported incidents The ICO acknowledges these figures represent only breaches that were discovered and reported within 72 hours. The true scale of data exposure is significantly higher. The average time to detect a breach is 277 days. ### Once data is breached, fraud follows The UK Government model identifies three breach-to-fraud journeys: direct monetisation of financial data, identity theft from personal records, and bulk credential exploitation. Firevault addresses all three by taking data offline entirely. Sources: [Frontier Economics for DSIT/Home Office (June 2025)](https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf) · [NCA National Strategic Assessment 2025](https://www.nationalcrimeagency.gov.uk/threats-2025/nsa-fraud-2025) · [KPMG Sector Costings (April 2025)](https://assets.publishing.service.gov.uk/media/68b1bdd5cc8356c3c882a904/Economic_modelling_of_sector_specific_costings_of_cyber_attacks.pdf) · [Alma Economics IP Theft (July 2025)](https://assets.publishing.service.gov.uk/media/691442809d50fc2fe8161635/Economic_Impact_of_IP_from_Cyber_Attacks_-_ALMA_ECONOMICS.pdf) · [KPMG Consumer Impact (April 2025)](https://assets.publishing.service.gov.uk/media/6914486cb49cc44345161638/Impact_on_consumers_of_cyber_attacks.pdf) · [KPMG Rail Scenario (April 2025)](https://assets.publishing.service.gov.uk/media/69144f259d50fc2fe816163a/Economic_impact_of_a_systemic_cyber_incident_rail_sector_scenario.pdf) · [ICO Incident Trends](https://ico.org.uk/action-weve-taken/complaints-and-concerns-data-sets/data-security-incident-trends/) · [Cyber Breaches Survey 2025](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025) 02 The Solution ## One Architecture. Four Root Causes. Complete Protection. Firevault does not try to patch each root cause individually. Our physically disconnected architecture addresses all four simultaneously by removing the fundamental assumption that data must always be reachable. No path for attackers Limited blast radius Physical air gap Works without experts ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Address every root cause of data loss See how offline architecture eliminates the fundamental vulnerabilities behind every breach. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up