We received contact from a company that said it had suffered an attack and was unable to continue its activities. When they arrived at their offices just after the weekend, they realised that much of their data was inaccessible.
The situation was as follows: More than 10 virtual machines, all hosted on Windows Server, which were no longer booting due to malware in the environment, which prevented the company from functioning.
After hacking into the environment, the Lockbit hacking group demanded a ransom of more than 20,000 euros. A ransom that the company refused to pay.
After that, the search began for a company capable of recovering their data and, with many fears about the possibility of recovery without paying a ransom, they found Digital Recovery. We soon positioned ourselves as the solution to the problem.
Due to fears about the solutions on offer and the possibility of decryption, only one infected VHDX was forwarded, which we understand perfectly – after all, that’s what we hear.
We then carried out an advanced diagnosis which resulted in a promising scenario that made recovery possible. With the company’s authorisation and the diagnosis carried out, we began recovering the data.
Seeing that we had managed to fulfil our promise with one VHDX, the client was quick to send the others. We set a deadline for the checkpoints during a project, which allowed the client to feel increasingly relieved.
The company needed one of its VHDXs to be restored as a virtual disc and then booted into a VM. A demand that was successfully met.
Thanks to the skills of our experts, with the help of Tracer, our proprietary technology, 100 per cent of the encrypted data was recovered. In just a few days, we were able to prevent a fatal loss of time and money for the company and its customers.
A ransomware attack cannot be prevented, but data loss can.
