> The practice did have backups in place, but report that the backup data was also corrupted by the unauthorized individual.

So in other words they failed to make a backup.

Saving your backup files to the same system that you're backing up is not making a backup.

Saving your backup to tape/external disk an moving those to an offsite location is how to make a backup.