I lost a site once. Not to hackers, to a botched hosting migration, and the only backup I had was sitting on the same server that died. That was an expensive lesson in what a backup actually is.
The quarter that just ended makes the point louder. Infosecurity Magazine flagged Q3 2026 as a record for ransomware attacks, and a Semperis report out this month says roughly a quarter of campaigns now include threats against staff. Gangs are getting nastier, not quieter.
You don't run a casino floor. You run a blog, a newsletter, maybe an indie author site with a few years of manuscripts and subscriber lists on it. The scale is different. The failure mode is identical, and the people who got hit hardest have already shown what recovery looks like when it goes right and when it goes wrong.
What the Nevada casino breaches actually taught everyone
In September 2023, MGM's Las Vegas properties were knocked into manual operation, with slot floors, room keys and booking systems all affected. Caesars was hit in the same wave. Nobody was breaking into vaults. They were taking away the ability to run the business.
For a casino, the damage lands in three places at once. Downtime burns money by the hour. Loyalty and comp data, the stuff that tells you who your best customers are, becomes both a liability and a target. And because Nevada is one of the most tightly supervised gaming jurisdictions anywhere, regulators are watching how you handle it. If you want the wider picture of how those licensed operators are structured, a quick look at:
will show you how much of that industry runs on records it cannot afford to lose.
The two companies then split on strategy. Caesars reportedly paid about $15 million to get its data back. MGM refused and ate the downtime. Both paths hurt. The lesson for a small operator is blunt: the only way to avoid choosing between a ransom and a rebuild is to have a clean copy nobody can touch.
That's the whole game. A casino with a restorable backup negotiates from strength. One without it pays or crawls.
Why your backup probably isn't one
Here's the thing most bloggers get wrong. A backup that lives on the same server, the same cloud account, or the same logged-in laptop as the original is a copy, not a backup. Ransomware doesn't just encrypt your files. It goes looking for the backups first.
CISA says as much in its #StopRansomware guide: keep offline, encrypted copies and actually test restoring them, because attackers delete or encrypt whatever backups they can reach. Reach is the key word. If your backup folder is mounted on the machine that got compromised, assume it's gone.
So the design question isn't "where do I store this?" It's "what is the one place an attacker with my admin password still can't get to?"
The playbook, scaled down
Here's the version I'd run on a blog or an indie author site today. It borrows the casino lessons without the casino budget.
Step 1: Decide what you can't rebuild. For a blogger that's usually the database, uploaded images, the theme customizations, and the email list export. For an author it's manuscripts, cover files, and royalty spreadsheets. Write the list down. Everything else you can reinstall.
Step 2: Follow 3-2-1, then add a gap. Three copies, two different media, one offsite. The extra piece is separation: at least one copy must live in an account with different credentials, ideally with no standing connection to your main machine. Worth it.
Step 3: Make one copy immutable or offline. Object storage with write-once settings does the job, as does an external drive you plug in weekly and then physically unplug. The FTC's small business cybersecurity guidance recommends saving full backups to a drive or server that isn't connected to your network. Boring advice. It works.
Step 4: Encrypt before it leaves your machine. If the offsite provider gets breached, your backup stays unreadable. Keep the key somewhere separate from the backup itself, and print or store a copy offline. A key locked inside the thing it protects is useless.
Step 5: Schedule it, then forget about it. Daily for the database, weekly for the full file set. Manual backups happen the week after you needed them.
Test the restore, or you have nothing
This is the step everyone skips and the one that matters most. Successful job notifications prove a file got written. They don't prove it opens.
Once a quarter, pick a staging site or a spare machine and restore from your offsite copy. Time it. If it takes four hours, you now know your real downtime, which is the number a casino calculates in dollars per minute. Mine took longer than I'd guessed the first time, because I'd never written down the database password for the restore account. Small failure. Would have been a catastrophe on the day it counted.
Keep a plain text runbook, stored offline, that says: where the backup lives, how to decrypt it, the order to bring things back, and who to call at your host. Five minutes to write. Priceless at 2am.
Don't forget the people side
The scary detail in this year's ransomware data is the threats against staff. For a solo blogger that's less relevant, but the underlying point isn't: attackers get in through accounts, not firewalls. Turn on two-factor authentication on your host, your registrar, your email, and your backup provider. Use a password manager. Don't reuse the same login across the stack.
If you've read the publisher's zero-trust and network firewall pieces, this is the same philosophy at hobbyist scale. Assume something will get compromised and make sure it can't take everything with it.
Putting it together
A casino can survive a breach because it has money, lawyers and a recovery team. You have a laptop and a Saturday afternoon. That's enough, if you spend it on the right things: a separated copy, an encrypted copy, and a restore you've actually run.
The record ransomware quarter isn't going to be the last. Build the plan before you need it, and test it before you trust it.
FAQ
How often should a blogger back up? Daily for the database if you publish often, weekly for the full site files. Match the schedule to how much you can stand to retype. If losing a week of posts would hurt, back up daily.
Is cloud storage enough as an offsite backup? Only if it's separated from your main credentials and ideally immutable. A synced folder that mirrors deletions will happily mirror encrypted garbage too. Use versioned or write-once storage instead.
Should I ever pay a ransom? A clean, tested backup makes the question moot. Caesars reportedly paid around $15 million while MGM declined. Without a restorable copy you're stuck choosing between two bad options.
How do I know my backup actually works? Restore it. Quarterly, onto a staging site or spare machine, and time the process. Job success messages only prove a file was written, not that it opens.
What should I keep offline? Your encryption keys and a written runbook, at minimum. If both live inside the backup system, an attacker or a failed drive takes them with everything else.
Gambling involves risk. Please play responsibly and only wager what you can afford to lose. If you feel gambling is becoming a problem, visit BeGambleAware.org or call 1-800-GAMBLER.