osinix

You can use old school way. You can have a tape backup, ssd, or a device that is not connected to the network constantly. Copy there and unplug the device.

The backups got wiped together with the systems, so they were reachable from same network. A backup the attacker can reach is not a backup. Good they had an offline copy, but a system this important should have that as regular schedule, not depend on luck.