50TB Encrypted Over Carnival — How Instant Recovery Saved a $1M Operation - World Backup Day
It was a holiday weekend here in Brazil, Carnival, and I was off when I got the call around noon.A client had been hit by a ransomware attack.The entry point was a phishing email that compromised a workstation. From there, the attacker managed to move laterally, reach Active Directory, and eventually gain access to the entire environment.By the time I was involved, most of the damage was already done.Around 50TB of Windows-based VMs were encrypted. Production was down.The environment did have antivirus in place, but it wasn’t properly configured to stop that kind of behavior. In the end, it wasn’t enough. At that moment, the biggest challenge wasn’t just restoring the environment, it was figuring out when it had actually been compromised. Without that, choosing a restore point becomes a risk.You might bring everything back… already infected.That’s where Veeam Software made all the difference. It wasn’t a straight path, each restore point helped us understand how far the compromise had
