Client Overview

A well-established accounting firm with over 12 years in business faced a catastrophic data loss event due to a ransomware attack. The client relied on on-site servers for business data storage and used cloud backup for redundancy. Unfortunately, their cloud backup was hacked, and their local backup had been failing unnoticed.

Initial Problem

The client had been relying on a popular retail level cloud storage solution for their backup needs, in addition to an on-site backup server. However, when the ransomware attack occurred, it was discovered that the cloud backup had been completely compromised, and the local backup had been failing unnoticed. This left the business at risk of total data loss.

The crisis unfolded when the client started their workday and saw a ransomware message on their screen, indicating that their files had been encrypted. The client immediately contacted Nanojot’s IT support team, who conducted a rapid assessment and found:

• Some files were deleted by the hackers.
• Some files were encrypted, rendering them inaccessible.
• Software configurations were altered, potentially exposing vulnerabilities.
• The local backup server was down, meaning recent data was not recoverable from it.
• The cloud backup had been entirely wiped out by the attackers.

These findings meant the firm was at risk of losing critical financial records, jeopardizing the business entirely.

An unexpected problem during the recovery process was that the very popular cloud storage provider, which typically claims to retain deleted data for 93 days, was completely unresponsive. Despite multiple attempts to reach their support team over a two-week period, we received no response, further emphasizing the unreliability of retail level cloud backup solution.

Immediate Response & Containment

• The Nanojot team remotely shut down the server to prevent the infection from spreading.
• All employees were logged out and disconnected from the system.
• An on-site assessment was conducted to evaluate the extent of the breach.

Upon investigation, it was discovered that weak desktop passwords allowed hackers to infiltrate the system via a directory attack. From compromised desktops, attackers gained access to the main server, encrypting and deleting valuable data.

Security Reinforcements & Long-Term Prevention

After mitigating the attack and recovering the data, we reinstated the server on a new temporary server to ensure business continuity while assessing the security of the original environment.

To ensure long-term resilience, we made the strategic decision to remove the cloud backup due to two critical drawbacks:

• Recovery time concerns: Cloud backup retrieval times were too slow for the business’s operational needs.
• Security risks: The previous cloud backup used a syncing technology rather than a true backup solution, making it more vulnerable.

Instead, we recommended the implementation of an off-site physical backup solution, ensuring that in case of an emergency, the business could regain access to its critical data quickly.

Additionally, we performed a complete reinstallation of Windows on multiple suspect desktops that showed potential security vulnerabilities. This eliminated any potential backdoors left by the attackers and ensured a completely clean system moving forward.

Furthermore, we conducted a comprehensive review of antivirus logs on all desktops and the server. Surprisingly, the logs showed no indication of an attack, raising concerns about the effectiveness of the installed antivirus solution in detecting ransomware threats. Our next step is to engage with the antivirus service provider to investigate why the ransomware attack was not detected or logged, and whether enhancements in threat detection mechanisms are required.

To prevent future attacks, the following security upgrades were implemented:

• A pull-only backup system, ensuring backups remain undiscoverable to attackers.
• A secondary firewall & router isolating the backup server from the main network.
• Stronger authentication policies, enforcing minimum 12-character passwords with uppercase, lowercase, numbers, and special characters.
• Two-factor authentication (2FA) recommended for server logins.
• Removable backup storage introduced for additional off-site protection.

Additionally, an automated off-site backup system was scheduled for implementation.