Redstor Rescues Schools Hit by £1M Ransomware Attack

Click here or press enter for the accessibility optimised version

Redstor rescues schools hit by £1m ransomware attack

Data recovery possible thanks to recommendation by ComputerWorld Click here or press enter for the accessibility optimised version

Cyber-criminals encrypt onsite backups Redstor was a 'godsend' Monmouth School for Boys was founded by William Jones, a member of The Worshipful Company of Haberdashers, in recovering data 1613 during the reign of James I. The foundation now also supports Monmouth School for Girls, Monmouth School Girls’ ComputerWorld’s advice to use Prep, Monmouth School Boys’ Prep and Monmouth Schools Redstor for data protection proved Pre-Prep & Nursery. Former pupils have had outstanding invaluable when only months later careers in the arts, academia, sports, the media, Armed a £1 million ransomware attack Forces, retail, the Church, politics and the Civil Service. paralysed Haberdashers’ five schools in Monmouth. ComputerWorld and Haberdashers’ “ComputerWorld worked closely with Cyber-criminals were demanding an Not only did cyber-criminals wipe Monmouth Schools had embarked Haberdashers’ Schools to identify initial £500,000, rising to £1 million out vital files belonging ot pupils and on their new strategic partnership the value they wanted from offsite after six days to unencrypt the data. staff, they also encrypted onsite early in 2020. There was a focus on back-up. One of the key areas was backups held on disc and tape by a digital transformation and improving speed of recovery for student and Fred recalled: “They had found all the leading global provider of disaster the teacher and student learning staff data, which is where Redstor devices and servers on the network, recovery solutions. experience. really shines.” created a domain admin account and started trawling through our Recovering that data would have Account manager Chris Burgess This proved crucial when data to see what was valuable to us. been virtually impossible, had Fred said: “Offsite data protection and ransomware found a way in through There was nothing they couldn’t do. Welsby, Director of IT at recovery was quickly identified as an a domain admin account, spreading Haberdashers, not taken up a area of focus. It was important to quickly through the main “I came into work to find my recommendation from the schools' ensure data would be safe in the infrastructure, knocking out file engineer calling it ‘a disaster’. managed service provider to deploy event of a major hardware failure or servers and Exchange and SQL Nobody could log onto any Redstor. ransomware attack. servers. computers. Teachers and pupils had no access to any of our services, no access to any of our services, “I was very relieved that we had databases or email systems. decided to get Redstor and very Basically it was back to paper and happy with the support pencil. ComputerWorld provided during an incredibly difficult time." “Thankfully, due to previous minor malware incidents that we’ve had over the past four or five years, I had ComputerWorld has a vast recently decided to engage with amount of experience when Redstor to have a cloud backup it comes to data protection system installed.” and recovery, along with helping organisations Redstor immediately set about recover from major restoring the SIMS server and pass incidents such as server into VMware. ransomware. The fact that we had implemented Fred said: “We’ve had ransomware Redstor gave us added attacks in the past and the financial peace of mind that loss of a lack of teaching is an Haberdashers’ schools’ expensive thing - far more than the critical data was safe and cost of a decent security system easily recoverable.” with a decent backup. would have been with very limited and running very quickly - mainly services for a month or longer. email and Microsoft 365 Chris Burgess, ComputerWorld account “It was a very bad attack, but it could authentication that was hosted on- manager have been a lot worse. Had we not “ComputerWorld helped us get our prem, which enabled us to start had a cloud backup system, we most important services back up teaching again. ShareShare onShare T on LinkedIn on Facebook would have been with very limited and running very quickly - mainly recovery. Redstor gets users up and Schools running at the click of a button.

now big Haberdashers deployed Redstor to comply with the legislation and targets guidelines, outlined by Ofsted and the Data Protection Act, and However, storing backups in minimal. The cloud backups were enforced by the Information The UK’s National Cyber Security Redstor’s geographically separate unaffected and were critical in Commissioner’s Office, which Centre (NCSC)recently warned of a data centres ensured there was an restoring our systems.” requires schools to securely back up spike in the targeting of schools, airgap between the schools’ live data data offsite on a daily basis. universities and colleges. and backups - and encrypting the data before it was sent to the data We had 15TB protected by Principal James Murphy-O’Connor The Department for Education and centre meant the ransomware was Redstor - and that was an said: “Communication with the Government’s cyber-security arm unable to execute and compromise absolute ‘godsend’. We governors, Haberdashers Hall in recently became so concerned the Redstor backup platform. could access files restored London, staff and parents was at a about the number of ransomware from Redstor within a few standstill. Without Redstor it would attacks affecting the education Fred recalled: “We did have another minutes once the restore have been far worse. I'm told the sector that the DfE sent out a backup software on-prem – and one had started.” impact of a ransomware attack can circular, advising schools to review of the backup servers was on last months.” their defences urgently. domain. That was fully encrypted, so Fred Welsby, Director of IT at they hit our backup systems as well. Haberdashers' Monmouth Schools Haberdashers continue to work with Haberdashers’ system was hit by ComputerWorld's in-house team, sodinokibi, the ransomware variant “However, we were able to recover With InstantData - Redstor’s unique, who ensure a bespoke security that temporarily forced Travelex that server to the previous day with user-driven streaming technology - strategy is implemented throughout offline. Redstor, so the loss of data was very there is no need to wait for a full the schools. minimal. The cloud backups were recovery. Redstor gets users up and Challenges Key Benefits

Recovering data after ransomware attack Stream data in real time to any device, making downtime a thing of the Keeping schools working while data is recovered past Managing data effortlessly on-prem and in the cloud No need to wait for full recovery - gain immediate access to automated, Difficulty finding expert support encrypted and secure online backup and recovery Easy installation with ability to scale up or down as demand changes Fast 24/7/365 access to a support team that draws on 20 years’ knowledge and experience within the storage and backup industry Solution

InstantData, Redstor’s unique on-demand streaming technology A data management solution that delivers reliable backup and recovery and DR Cloud-based protection with no hardware costs Support provided by an organisation that is both the technology vendor and infrastructure owner Click here or press enter for the accessibility optimised version

Borderless visibility of data With a unique solution that is built centres. The encryption key is set by “We suspect that a key logger was logged into our systems via a VPN for the cloud, Fred is able to the customer, ensuring no installed on one of the surfaces, non- and then started creating their own discover, manage and protect the unauthorised access. maliciously, probably an accidental accounts and this was done data of all five schools with ease. install by a member of staff. Our IT overnight. This is particularly important for support went to support them. He Running on servers, laptops and schools, who have to retain their last logged on with his account, which “We no longer have all our IT team workstations, with backup seven years of data, protecting was a domain admin. as domain admins. Now we have a selections profiled from the financial details and safeguarding delegation of tasks and roles for management console, Redstor information on pupils. “The cyber-criminals trawled the each person. It’s inconvenient, but provides rapid and granular restore credentials from that account, far more secure.” for Microsoft 365, Google Fred recalled: “During the pandemic logged into our systems via a VPN Workspace, Google Classroom and we installed new touch screens in all SaaS applications. classrooms and teachers received Microsoft surface devices. Redstor unifies backup, instant-data recovery and "We had so little time to get access and data migration everything set up that it was decided through a secure, central to give staff local admin access. console, enabling borderless This allowed teachers to calibrate visibility of Haberdashers’ the screens each time they moved entire data estate at any from room to room. time, on any device. “It also made it possible for them to install a printer or another device at Multiple copies of backups are held home, but granting this is not a good securely encrypted in UK data idea. centres. The encryption key is set by Scale easily, no hardware

Not only are traditional backups Fred revealed: “We are preparing to costly, complicated and time- migrate all of our emails to consuming, they cannot scale to Microsoft 365 in the cloud once we support the explosion in new apps have adequate security. We currently and growing data sets. have 90 users in the cloud and the remaining 1500 on prem in an As well as removing manual Exchange server. overheads, Redstor allows Haberdashers to budget confidently, “Our intention is to use Redstor to scaling easily with no hidden costs cover all of our on-prem and M365 or surprises. backups for the future.” Expert support

Redstor’s clients have 24/7 access to a support team that draws on 20 years’ knowledge and experience within the storage and backup industry.

If Haberdashers ever needs support, the principal has the reassurance that the schools' IT team is speaking to an organisation that is both the technology vendor and infrastructure owner.

Most important of all, though, for "Some colleagues were slightly you, the result is that you get better hours speaking to people concerned James was that Redstor’s support concerned about what the because of them. about what they needed to do. team were there for him when he ransomware attack could lead to – needed them the most. paying out big ransoms, but I sensed “I contacted the secretaries of four “We made a list of four or five that having an expert organisation separate associations for recommendations and having He said: “Having that expertise and like Redstor with us – all things independent to forewarn them about Redstor was one of them, so reassurance allowed me to believe would be ok and there would be a being a target for ransomware and I hopefully a few schools will be saved all would be well. good income. Like all things that test was on the phone several days for from what we went through.” you, the result is that you get better hours speaking to people concerned Click here or press enter for the accessibility optimised version

Thank you for reading Haberdashers Case Study