Backing up data is a security must. However, it also have certain level of risks when mishandled. Which of the following is the greatest threat posed by backups?

While malware can be stored in backups, this is a less common and lower-impact risk compared to the exposure of unencrypted sensitive data.

An incomplete backup is an availability concern that affects recovery, but it does not represent a direct threat to data confidentiality or integrity.

Backup unavailability during disaster recovery is an operational risk, not a security threat that could lead to data exposure or breach.

Unencrypted backups represent a critical confidentiality risk because if the physical media is lost or stolen, any party can access the full contents without authentication. This directly violates the principle of data confidentiality and can result in a large-scale data breach. Encryption of backups at rest is a mandatory control to mitigate this risk.