How MicroAge Ransomware Remediation Kept this Organization in Business

“Our network is secure. We don’t need to worry about ransomware attack remediation.”

“We’re too small.”

“We don’t have the budget for that level of security.”

For many companies, the objections to anti-ransomware software are real—and understandable. But they don’t hold true for a lot of organizations. In fact, one health care company with providers located across the U.S. recently turned to MicroAge when they discovered they weren’t too small or insignificant to be a target.

MicroAge solutions expert Rick Walsh had counseled his long-time client on the need for security precautions, but for various reasons, security remained on the back burner. On a Thursday, the IT manager of the two-person IT department called Rick with a huge problem.

“He said all of his servers and 100 computers were locked,” Rick recalls. “A message on the screen was asking the company to pay 17 bitcoins to the hacker’s account. That’s about $32,000.”

The client needed help immediately, but Rick wasn’t sure if this could be remediated. He called on the MicroAge Security team.

Ransomware attack remediation requires special expertise and often can’t be fixed—which means the best offense is a good defense to prevent attacks.

When hackers infiltrate companies demanding a ransom in exchange for the encryption key, the ransoms are actually often affordable. (The average ransom demanded is around $700.) And while there is no guarantee you’ll actually get the key, for many companies, it’s the only option.

Ransomware Attack Remediation

Before considering paying the ransom, Rick brought in MicroAge Services to help. Starting at 5 p.m. local time, the technician sought to determine if he could repair the damage of the CryptoLocker attack.

“I found that everything on the network had been encrypted … all of their backups, all of their servers. There was hardly anything left untouched,” he says. “All of their backups were gone. The virus had encrypted everything.”

Ultimately, a serendipitous stroke of luck saved the client. The consultant, a NetApp storage architecture pro, discovered there was only a two-minute gap between the last clean NetApp snapshot and the time the encryption started. Had this snapshot been corrupted, the client’s only alternative would’ve been to “pay and pray.”

It took a few days to get everything back online, but with MicroAge’s help, the company was back up by Monday.

The damage of a ransomware attack is clear, but these attacks do more than lead to dollars out the door due to downtime. There are also regulatory implications.

If your organization is in a regulated industry beholden to compliancy standards such as HIPAA or PCI you must maintain control of your data at all times. For example, if you were hacked, data encrypted, data deleted, or data lost, it’s considered a breach. You have to report that breach and could be subject to fines or consequences.

Preventing Future Ransomware Attacks

Next came the work of preventing this type of attack in the future. On Rick’s recommendation, the client deployed Sophos Intercept X, a product designed to stop the malicious encryption process that is indicative of a ransomware attack. Once the attack is stopped, Intercept X Cryptoguard reverts files back to safe versions and alerts IT that a ransomware attack was thwarted to allow IT insight into their vulnerabilities.

The client also brought MicroAge on board to provide security as a service, which includes ongoing intrusion detection, vulnerability scanning and analysis, file integrity monitoring and more.