[xur17]

For a concrete example, someone could infect an image storing service with code that encrypts (and silently decrypts) the data when it's stored / retrieved. When the hacker removes the decryption key from the running service, the backups will also be inaccessible because they are also encrypted.

[Workaccount2]

Wouldn't this be a bright red flag that is trivial to check for?