Yesterday, All those backups seemed a waste of pay. Now my database has gone away. Oh I believe in yesterday. Suddenly, There's not half the files there used to be, And there's a milestone hanging over me The system crashed so suddenly. I pushed something wrong What it was I could not say. Now all my data's gone and I long for yesterday-ay-ay-ay. Yesterday, The need for back-ups seemed so far away. I knew my data was…
Danish cloud host says customers ‘lost all data’ after ransomware attack
11–20 of 81 posts
Re: Danish cloud host says customers ‘lost all data’ after ransomware attack
#12Yesterday, All those backups seemed a waste of pay. Now my database has gone away. Oh I believe in yesterday. Suddenly, There's not half the files there used to be, And there's a milestone hanging over me The system crashed so suddenly. I pushed something wrong What it was I could not say. Now all my data's gone and I long for yesterday-ay-ay-ay. Yesterday, The need for back-ups seemed so far away. I knew my data was…
Also temporally separated. That is you must have backup that is beyond attackers time horizon. This is only way to get back at least something.
Re: Danish cloud host says customers ‘lost all data’ after ransomware attack
#13* Just a rant and parody
Re: Danish cloud host says customers ‘lost all data’ after ransomware attack
#14The little restic backup saved him. It pushed one copy of nonsense, but kept several revisions of the old data.
On a similar note: does anyone have any experience with mdisc? They seem like the perfect solution for long time storage for me at the moment.
Re: Danish cloud host says customers ‘lost all data’ after ransomware attack
#15...after a thorough analysis of the now encrypted logs?
Re: Danish cloud host says customers ‘lost all data’ after ransomware attack
#16Earlier quoted context omitted.
According to the company the attacker managed to encrypt both the primary and secondary backup systems.
Backups need an air gap.
Then try to explain that rotating a few dozen TB of data offsite to cold offline storage every week isn't cheap. Because unlike some vendors, we take pride in data integrity and ensuring that our DR plan is actually.... you know, recoverable :P
Re: Danish cloud host says customers ‘lost all data’ after ransomware attack
#17Earlier quoted context omitted.
the 1 in the 3-2-1 should be somewhere on premise or at least not directly reachable from the internet. Think: ssh cron job that copies backups from cloud to cold storage
And what if the backup you're copying to cold storage is also encrypted? How did the saying go? You don't have backups until you've successfully restored from them or something like that. =) Basically any 3-2-1 system is Schrödinger's backup until you've actually used it.
Re: Danish cloud host says customers ‘lost all data’ after ransomware attack
#18" there was no evidence that customer data was copied out or exfiltrated from its systems" ...after a thorough analysis of the now encrypted logs?