Detecting data corruption in a storage system includes examining portions of the data for encryption anomalies and providing an indication in response to detecting an encryption anomaly. The encryption anomalies may be based on entropy of the data. The entropy of the data may vary based on an inherent nature of the data. One of the portions of data may be deemed to be encrypted in response to an entropy value exceeding a predetermined threshold. The predetermined threshold may be based on prior data accesses. The predetermined threshold may be determined using machine learning. Portions of the data may be examined for encryption anomalies during data accesses. Data accesses may be suspended in response to detecting an encryption anomaly. Encryption anomalies may include data that is flagged to be encrypted not being detected as being encrypted and/or data that is flagged to not be encrypted being detected as being encrypted.