Hit by a ransomware attack
A Canadian managed cloud service provider faced a severe security breach when a ransomware attack infiltrated their systems. The attack was initiated through a vulnerability in a business partner’s customer system, leading to the encryption of all data managed by the provider. Having recently acquired new infrastructure, the provider was operating with limited tooling and lacked a log retention strategy, complicating its ability to respond effectively to the breach.
Identifying and mitigating the threats
To counter the ransomware attack, the provider worked with Kivu, a part of Quorum Cyber, to rapidly deploy endpoint detection and response (EDR) solutions to identify and mitigate the threat. Additionally, Kivu was engaged in negotiations and facilitated payment, enabling the successful decryption of the compromised data. Subsequently, Kivu, a Quorum Cyber company, conducted a thorough forensic analysis to identify the initial point of compromise, known as “patient zero.”
Recovering with stronger security
The interventions led to several significant outcomes:
- Enhanced Security Monitoring: The provider established 24/7 Managed Detection & Response (MDR) coverage, ensuring continuous monitoring and rapid threat detection.
- Operational Restoration: All operations were successfully restored, allowing the provider to resume normal business activities without further disruptions.
- Legal Support: A critical forensic timeline was developed to aid the provider in its legal proceedings, offering detailed insights into the breach.
- Infrastructure Security Reinforcement: The Canadian company reconstructed its infrastructure with a strong emphasis on security defence principles, reducing vulnerabilities and strengthening its overall security posture.
By swiftly addressing the ransomware attack and implementing robust security measures, the managed cloud service provider restored its operations and also fortified its defences against future threats, ensuring the integrity and reliability of its cloud services.
Get in touch if you would like to talk through any of your cyber security needs.
