Abstract: A computer implemented method, data processing system, and computer program product for providing an autonomic defense when data tampering is detected in a data processing system where data is maintained and transmitted in unencrypted form. When notification of data tampering activity in the data processing system is received, a determination is made as to whether the data tampering activity meets or exceeds a threshold. If the threshold is met or exceeded, an encryption key is read from a persistent storage location into memory. The key is erased from the persistent storage location. The data in the data processing system is encrypted using the key to form encrypted data. The key is then erased from memory.