How to Investigate an Unexpected Increase in Cloud Backup Deletions

A deletion spike may be caused by lifecycle changes, cleanup automation, administrative action, or a compromised identity.

Checks to make

Preserve audit events and backup job history, identify actor, policy, and affected resources, and compare with approved changes. Confirm recoverability from remaining copies, then restrict destructive access if activity cannot be explained.

When to get help

Security operations can investigate deletion activity and coordinate recovery. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.