In the world of cloud services, ransomware is a constant, menacing presence. MedOne, a managed data center services provider in Israel , recently demonstrated the crucial role of Zerto’s continuous data protection platform in a real-life crisis. This case underscores the technicalities of a successful ransomware recovery and why it’s essential for modern IT.
MedOne, a well-known cloud provider in Israel, is laser-focused on data protection and recovery. Their dual-environment setup, where one environment is fully independent of the other, is there so that if one goes down, the other keeps running during recovery. This setup was vital when a medical software client was hit by a ransomware attack.
The Attack: A 15-Server Nightmare
In March 2021, a ransomware attack hit, it was the worst in MedOne’s eight-year history. The client’s 15 production servers, which held some 20 terabytes of data, got encrypted. They were facing the potential loss of 30 to 40 days of data! MedOne’s team got on it fast, identifying the encryption within 15 minutes. The first hurdle was pinpointing when the attack happened to allow for the fastest recovery possible.
Zerto’s Precision Recovery
MedOne relied on Zerto’s point-in-time failover tests. Zerto enabled them to narrow down the timeframe when the encryption happened to a five-minute period. This level of granularity is not something you usually get with traditional solutions. It allowed MedOne to reduce data loss to almost zero. With the moment of encryption identified, they secured the environment, using Zerto to open the firewall and deploy needed endpoint detection, response updates, and more antivirus protection.
Rapid Recovery: A One-Hour Turnaround
The incredible part of this was the recovery speed. MedOne brought the client’s entire production environment back up in just one hour. This is the power of Zerto’s ability to maintain an ‘always-on’ business. “The CEO of the company we helped told me that MedOne and Zerto saved his company. Everything they had was encrypted, even the backup. The Zerto solution had them back up and running in a full production environment within an hour,” said Shuki Klainshtein, MedOne Cloud Delivery Manager. The ability to failback is crucial because “if you need to failback but don’t have anything, that’s a way bigger problem than anything else,” Klainshtein also noted.
From Recovery to a Secure Future
The successful recovery led to the client moving their entire infrastructure to the MedOne Cloud. Now, they have a two-environment system with production on one and disaster recovery on the other. The customer, who previously ran servers on Microsoft Azure, now understands the importance of local support along with the failback capabilities. Looking ahead, MedOne intends to use Zerto to migrate more of the client’s on-premises servers to MedOne Cloud, a process they say takes hours instead of days.
Key Takeaways for Tech Professionals
- Granular Recovery is Key: The ability to pinpoint the exact moment before an attack is critical for reducing data loss.
- Speed Matters: Quick recovery is paramount to keep business disruption to a minimum.
- Continuous data protection helps maintain data integrity
- Cloud Adoption: Moving to a cloud setup increases disaster recovery options.
- Failback is essential: The ability to failback is crucial to ensuring business continuity.
MedOne’s experience with Zerto shows the importance of having a strong data protection platform. The ability to recover from ransomware attacks quickly, as demonstrated by MedOne, reduces damage from the immediate attack. It also provides a proactive approach for dealing with future threats. Zerto’s tech makes it possible for customers to keep business operations going even when they encounter ransomware threats.