We are running a raid 10 server with a daily incremental NAS backup in a separate building and a revolving weekly/monthly RAID 5 NAS on the WAN a mile away.  We should also be doing a monthly full backup and taking it offsite and switching the tWo portable HDD’s but that doesn’t always happen.  

I think we could be ransomed, but it would take 1-2 months until we finally had enough backups compromised.

I do some separate stuff on OneDrive and try to keep it synced to two different machines.