Many NZ businesses assume Microsoft 365 data is safe by default. Then something goes wrong. Here are four real-world data loss scenarios — and what they actually cost businesses that weren't prepared.
Research from Veeam and Backupify consistently shows that 1 in 3 companies have experienced cloud data loss — and that 32% of SaaS data loss is caused by accidental deletion. Despite this, the majority of New Zealand businesses using Microsoft 365 have no backup solution in place beyond Microsoft's built-in retention tools.
The scenarios below aren't hypothetical. They are patterns we see regularly across NZ businesses — and in every case, a backup solution would have turned a crisis into a minor inconvenience.
Scenario 1: Ransomware Encrypts Your Synced Files
Ransomware no longer just encrypts files on local hard drives. Modern ransomware attacks target cloud-synced storage. When OneDrive sync is active on an infected device, the ransomware encrypts files locally — and the sync client dutifully uploads those encrypted versions to the cloud, overwriting the originals.
Microsoft's version history can sometimes help recover recent versions, but ransomware that runs for days before detection may exhaust that window. Without a dedicated backup, every file in an infected user's OneDrive — and potentially shared SharePoint libraries — may be unrecoverable.
The cost: Ransom payments, business downtime averaging 21 days for SMBs, regulatory notification obligations under the NZ Privacy Act 2020 if personal data was affected, and reputational damage that's impossible to quantify.
Scenario 2: Accidental Mass Deletion
A staff member tries to reorganise a SharePoint document library. They select what they think is a subfolder and delete it. It turns out they selected the entire library — three years of project documentation, client proposals, and financial records, gone in a single click.
Microsoft's recycle bin holds deleted items for 93 days (second-stage recycle bin included), but this window has limits. If the deletion goes unnoticed — which it often does for shared libraries with multiple contributors — recovery may not be possible once the window closes.
The cost: Recreating lost documentation from email threads and memory, client relationships damaged by missing project history, and staff hours spent on recovery work instead of billable activity.
Scenario 3: A Departing Employee's Account Is Deleted
An employee leaves the business. HR notifies IT, the account is removed from Azure Active Directory, and — unless someone specifically preserves the data first — everything in that person's mailbox, OneDrive, and Teams conversations is deleted or becomes inaccessible.
For many businesses, a departing account contains years of client correspondence, project files, and institutional knowledge. Microsoft does offer a brief window to export data before deletion, but in the rush of an exit this step is frequently missed.
The cost: Lost client context, gaps in project continuity, and potential compliance exposure if the deleted account contained records subject to retention obligations.
Scenario 4: A Malicious Insider Wipes Shared Drives
A disgruntled employee — or a contractor whose access wasn't properly scoped — deliberately deletes files from SharePoint, empties shared mailboxes, or removes Teams channels before leaving the organisation. Unlike ransomware, this is targeted and intentional: the person knows where the important data lives.
Because the deletion is performed by an authenticated user with legitimate access, Microsoft's security controls don't flag it as an attack. By the time the damage is discovered, the retention window may already be closing.
The cost: Potential loss of irreplaceable business records, legal exposure if the deleted data was subject to discovery obligations, and — depending on what was deleted — significant competitive damage.
The Common Thread
In every scenario above, the data was in Microsoft 365. Microsoft's infrastructure was working perfectly. The platform was available, the authentication systems were functioning, and the Service Level Agreement was being met. The data loss happened within the platform — and Microsoft's built-in tools weren't enough to recover it.
This is the shared responsibility model in practice. Microsoft protects the infrastructure. You are responsible for your data. A dedicated backup solution is how you meet that responsibility.
What the NZ Privacy Act 2020 Requires
Under the Privacy Act 2020, organisations that experience a privacy breach — including data loss that affects personal information — must notify the Office of the Privacy Commissioner and affected individuals where there is a risk of serious harm. The financial and reputational consequences of a notifiable breach extend well beyond the immediate data loss.
Having a backup solution doesn't prevent a breach, but it can dramatically reduce the scope, duration, and severity — which directly affects your notification obligations and exposure.
Don't wait until one of these scenarios happens in your business. Talk to Optimyze about M365 Backup today.
