from googling a bit, it sounds like S3 versioning might be some protection there. but the catastrophic case is still bad.