Sometimes not that simple, the attack could have corrupted or deleted the backups, or the backups themselves could be the source of reinfection.