unless your data is legally required to stay confidential under HIPPA or similar law. Then a backup just keeps you operating but not immune to the threat of data publication.

What data needs to be confidential in the case of the Colonial Pipeline?

I'm sure that there's proprietary data. Maybe knowing how much oil / gasoline is flowing might allow some traders to make unfairly informed trades (or maybe not: only inside trading is illegal. If someone figures out the information some other way, its not illegal IIRC).

And maybe employee data should be kept private, but there's no HIPPA requirement on that. Its not like there's payment processors on this thing either, so no PCI compliance here.

So I'm not exactly seeing why backing up data would be an issue in this case.

While the threat of publication is a risk, the data has already been breached and you are no longer compliant with the law.

I wonder if companies still get fined if the data is just encrypted without any exfil