In this case, early detection and mitigation is far more important, as restoring data from backup doesn't help if the attacker has gotten ahold of the actual data and is willing to use it," Shteiman told SearchSecurity.