He's got a point though. It only really applies if your business is big enough or controversial enough to be worth blackmailing, but if the attackers are already encrypting your data, they can copy it first and threaten to release it if you aren't going to pay because you have a backup.