Ransomware attacks will often wait after getting into systems, so that they can also encrypt live backups. Air gapped backups from sufficiently long ago will work, but not only is restoring to those usually a pain in the ass, but would also come with significant business cost... which may be more than the ransom. That's the goal, anyway.
reply