Ransomware has become the attack of choice for cyber criminals worldwide. Hackers demand ransoms just low enough that organisations, facing potentially disastrous and costly disruption to their operations, give in and pay up. Experts anticipate this type of security attack will continue to increase as long as it proves to be a good way to generate income from unwitting businesses worldwide.
Harbour HR found themselves victims of just such a ransomware attack in December 2021. The ransomware encrypted their files and threatened serious disruption to their business functions, unless a fee was paid. As a DATAFORT customer, the end of the story for Harbour HR was significantly different, and very much happier than many companies faced with similar challenges.
Read the full case study below to see how DATAFORT’s services saved the day and Harbour HR the need for a big payoff!
Background:
Harbour HR is an established consultancy providing bespoke domestic and international HR solutions. From one off projects to ongoing long term support, Harbour’s expertise ranges from HR support, immigration assistance and employer risk assessment to special project assignments. The company also specialises in the delivery of bespoke Human Resource, Immigration and International Assignment advice, with a service provided by a team of highly qualified consultants with years of experience. Their goal being to provide professional, expert knowledge and exceptional services levels.
Challenges:
On the Monday, the 20th of December 2021, just before the upcoming holiday, Harbour HR suddenly realised that they had been attacked by a ransomware virus. Nigel Sellens, Managing Director reflected “the first thing we noticed was that we were being locked-out of some of our files. Then a message came up that said all our files had been locked and would only be released on the payment of a ransom fee”. This is a situation that is being faced by many organisations as the ramsomware attackers are becoming increasingly cunning in their methods. They trap many unsuspecting email users who inadvertently click on a file within an email that appears at face value to be perfectly genuine.
“This was a serious problem, we faced the possibility of losing all our data and not being able to access or use IT which would significantly harm our business” said Nigel Sellens. “Not only were they asking for a ransom in excess of £1,500, we would also always be in doubt as to whether the virus was really cleared from our servers.” In other words, was this initial £1,500 just the first in a long series of demands as some viruses can have backup measures that lie in wait so that if they have been ‘cleaned’ from the system can later re-infect the network without needing to breach the company’s security again.
Harbour called the support desk and were told to shut everything down so that we could assess the situation and form a plan to reverse the damage.
DATAFORT Complete Data Protection
Harbour were using DATAFORT’s Core Care Managed service that stored data on a dedicated backup appliances held both in the Harbour HR office and enterprise class data centres but on a separate sub-net to protect the backed up data from risks like virus infection. The service is based on scheduled intra-day backups which identify changed data at the block level, taking those changes and marrying them to the backup images maintained locally and in the data centre. Harbour chose to perform this process at 15 minute intervals throughout the business day. This limits the loss of data to the time between backups – 14 minutes.
This method of backup is particularly useful in the situation that Harbour HR faced. The key challenge with conventional daily backup is knowing when the servers were infected as data is backed up on a version basis, rather than by date. So determining which file version to restore requires a very time consuming process. This is because you have to go through the entire server making sure to restore only files saved prior to the infection. In addition, a day or more of data could be lost depending on the relative timing between the daily backup and the time of the infection.
In Harbour HR’s situation, DATAFORT service engineers were able to go back in 15 minute slots and identify when the virus was first introduced to the network, then restore the entire server to the point minutes just before it happened. This enabled Harbour HR to continue working with minimal loss of data. This is a much faster, cleaner process than traditional daily backup.
Outcome
DATAFORT were able to restore Harbour HR to a virus free environment within a few hours of them noticing the problem.
Nigel Sellens commented “This was amazing, we were back up and running within hours. I’ve not experienced this kind of issue before and it’s great to know it works and that we are secure!”
Contact DATAFORT Sales at 0800 45 44 35 or email us to find out how we can help protect you to protect your business from a full range of risks to your data and systems.