Ransomware incidents increased ~34% year-over-year (2024 → 2025). Recovery costs commonly reach hundreds of thousands to millions, depending on downtime and data loss. Attackers increasingly use double extortion (encrypt + steal data). Cyber security is quickly becoming one of the most important investments for companies large and small. Organizations now rely on a multilayered cybersecurity approach that includes employee training, endpoint protection platforms, advanced threat detection (EDR/XDR), spam filtering, identity controls like MFA, and a robust backup strategy. But once data is compromised, the most reliable way to recover quickly is still to restore from clean, verified backups. How does Veeam backup help protect data against ransomware? Immutable backups Immutable backups are copies of your data that cannot be altered or deleted for a defined retention period. Veeam provides immutability through multiple options, including Linux Hardened Repositories and Object Storage with Object Lock capabilities. These technologies prevent any user—even an administrator or a ransomware process—from modifying or encrypting your backup files. Immutability ensures you always have clean, recoverable data no matter what happens in production. Air-Gapping Air-gapping keeps backup copies isolated from the network, preventing ransomware from reaching them. Traditional air-gapping uses tape media that is removed and stored offline after each backup. Today, organizations also use rotated external drives or cloud object storage tiers that remain disconnected or isolated except during backup jobs. These offline or semi-offline copies ensure that at least one version of your data remains untouched by any attack. Veeam ONE Detecting ransomware early can be challenging. Veeam ONE provides continuous monitoring and now includes advanced anomaly-detection capabilities that use behavioral analytics to identify suspicious activity. By tracking metrics such as CPU spikes, abnormal write patterns, or unusual data change rates, Veeam ONE can alert administrators in real time and help stop an attack before it spreads. Veeam SureBackup SureBackup is a feature of Veeam that allows you to create a sandbox to test your backups before restoring them to production. It can run virus and malware scans on backup sets, automatically or manually. It ensures your data is not infected without the need to restore the data somewhere first. Secure Restore Secure Restore scans backup data for malware during the recovery process, ensuring you don’t accidentally reintroduce infected files into production. Veeam now supports multiple anti-malware engines and integrates the latest virus definitions at restore time. This gives you an added layer of assurance that the data you are recovering is clean—even if the original backup was created before a threat was known. Veeam DataLabs Unsure of a workload, or suspect it may be infected? DataLabs gives you the ability to restore the data to a fully secured and isolated environment to test. A fully isolated sandbox lets you run any tests you want without impacting production systems, so you can make sure your workloads are uninfected before you restore them. Ransomware protection alliance Veeam is part of a group of leading hardware and software companies, like HPE, Cisco, and AWS, that work together to make sure their products integrate using the highest security standards possible. They bring together the most powerful recovery solutions to combat ransomware. Veeam Backup & Replication is a powerful tool in the fight against ransomware, but its effectiveness depends on how it is implemented. Following modern best practices—such as the 3-2-1-1-0 rule (three copies of data, on two media types, one off-site, one immutable or offline, and zero backup-verification errors)—dramatically improves your ability to recover quickly. Combine immutability, air-gapping, monitoring, secure restore features, and regular testing to ensure your organization is prepared long before an attack ever happens. Contact ProCern to find out more about Veeam backup and recovery solutions for your organization.
Ransomware In May 2017, the National Health Service of England and Scotland was hit with the largest ransomware attack at that time. The attack affected an estimated 200,000 computers across 150 countries. The estimated economic loss ranges from hundreds of millions to four billion dollars. This attack, dubbed the WannaCry ransomware attack, catapulted network security to the top of many organization’s priority list. It brought to light the amount of damage that could be done by a malicious virus. What is Ransomware? Ransomware is a type of malicious software, or malware. It is designed to deny access to a computer system or its data until a ransom is paid. It is typically spread through phishing emails or by visiting an infected website. The virus works by encrypting all the data on the user’s hard drive. Then, it requests a payment, usually in the form of cryptocurrency, to be sent to the hackers. However, there is no guarantee the user will recover their files if they pay that ransom. Ransomware can be devastating for users and organizations. Currently, we are seeing a lot of government agencies, education organizations, and healthcare organizations targeted by these attacks. What precautions can you take? In order to protect your user’s and organization’s data, there are a number of precautions you can take. Most of which are best practice even without the threat of ransomware. First, keep all applications and operating systems up to date. Outdated apps and OS’s are the target of most attacks. This was the case in the WannaCry attack. Second, train users to avoid phishing emails. These are emails designed to look legitimate at first glance but have links that redirect you to an infected site, or attachments that download the malware directly. Phishing emails and sites are also associated with social engineering attacks designed to steal credentials. It is always a good idea to train users to never click on links or open attachments in unsolicited emails. Next, backup your data on a regular basis. Backing up your data is a good idea for a myriad of reasons. It can really save you in the case of a ransomware attack. Best practice would be to keep 3 copies of your backups, with one offline and another in a geologically separate location. These backups should also be regularly tested. A great way to control what is installed on your organization’s computers is access control. Restricting privileges may not allow malware to be installed on a system without an administrator’s approval. This will limit the spread of the malware through a network. Similarly, another useful tool for fighting malware is a spam filter on your emails. A strong spam filter will prevent most phishing emails from making it to users’ inboxes. It will authenticate inbound emails to prevent spoofing. What to do when you’ve been infected by ransomware The first thing anyone should do when infected by ransomware is to contact law enforcement immediately. You should report the infection to the FBI’s cyber task forces and internet crime complaint center. Currently, the FBI does not recommend paying any ransom. While it could cost organizations large sums of money to be down for any length of time, there is no guarantee that paying the ransom will restore your data. There are numerous cases of this happening. Some victims who have paid the ransom have even been targeted again. Other victims have even been asked to pay more after the original ransom to get all their data back. Paying may inadvertently encourage this criminal business model. This makes it more prevalent in the future. Once you have found out that you are infected, you should isolate any infected machines immediately. In addition, one should take any unaffected machines offline so they don’t get infected. Same goes for backups. They should be taken offline immediately to stop the ransomware from spreading into your backups. From there, you should follow your organization’s incident response plan. Follow any instruction given to you by law enforcement. There will never be any way that you can guarantee you won’t fall victim to one of these attacks. Malware is always evolving, just like security practices are. It will always be an arms race between hackers and security experts. Your best bet is to always follow best security practices, and to always have a plan to recover from any successful attacks. Where to report Activity FBI Cyber Task Force Internet Crime Complaint Center United States Secret Service Electronic Crimes Task Force Local Field Offices Contact ProCern to have an assessment done on your current infrastructure. Ask us about helpful hints to help keep your data secure.
Do you have control of your Microsoft 365 data? Do you have access to all the items you need? The typical reaction is, “Microsoft takes care of it all.” Microsoft takes care of quite a bit and provides a great service for their customers. However, Microsoft’s primary focus is on managing the Microsoft 365 infrastructure and maintaining uptime to users. They are empowering YOU with the responsibility of your data. The misconception that Microsoft fully backs up your data on your behalf is quite common, and without a shift in mindset, could have damaging repercussions when this responsibility is left unattended. Ultimately, you need to ensure you have access to, and control over, your Exchange Online, SharePoint Online and OneDrive for Business data. The misunderstanding falls between Microsoft’s perceived responsibility and the user’s actual responsibility of protection and long-term retention of their Microsoft 365 data. The backup and recoverability that Microsoft provides and what users assume they are getting are often different. Meaning, aside from the standard precautions Micrrosoft 365 has in place, you may need to re-assess the level of control you have of your data and how much access you truly have to it. As a robust and highly capable Software as a Service (SaaS) platform, Microsoft 365 fits the needs of many organizations perfectly. Microsoft 365 provides application Availability and uptime to ensure users never skip a beat, but an Microsoft 365 backup can protect you against many other security threats. 6 reasons why backing upMicrosoft 365 is critical 1. Accidental Deletion If you delete a user, whether you meant to or not, that deletion is replicated across the network, along with the deletion of their personal SharePoint site and their OneDrive data. Native recycle bins and version histories included in Microsoft 365 can only protect you from data loss in a limited way, which can turn a simple recovery from a proper backup into a big problem after Microsoft 365 has geo-redundantly deleted the data forever, or it has fallen out of the retention period. There are two types of deletions in the Microsoft 365 platform, soft delete and hard delete. An example of soft delete is emptying the Deleted Items folder. It is also referred to as “Permanently Deleted.” In this case, permanent is not completely permanent, as the item can still be found in the Recoverable Items mailbox. A hard delete is when an item is tagged to be purged from the mailbox database completely. Once this happens, it is unrecoverable, period. 2. Retention Policy Gaps and Confusion The fast pace of business in the digital age lends itself to continuously evolving policies, including retention policies that are difficult to keep up with, let alone manage. Just like hard and soft delete, Microsoft 365 has limited backup and retention policies that can only fend off situational data loss and is not intended to be an all-encompassing backup solution. Another type of recovery, a point-in-time restoration of mailbox items, is not in scope with Microsoft. In the case of a catastrophic issue, a backup solution can provide the ability to roll back to a previous point-in-time prior to this issue and saving the day. With a Microsoft 365 backup solution, there are no retention policy gaps or restore inflexibility. Short term backups or long-term archives, granular or point-in-time restores, everything is at your fingertips making data recovery fast, easy and reliable. 3. Internal Security Threats The idea of a security threat suggests hackers and viruses. However, businesses experience threats from the inside, and they are happening more often than you think. Organizations fall victim to threats posed by their very own employees, both intentionally and unintentionally. Access to files and contacts changes so quickly, it can be hard to keep an eye on those in which you’ve installed the most trust. Microsoft has no way of knowing the difference between a regular user and a terminated employee attempting to delete critical company data before they depart. In addition, some users unknowingly create serious threats by downloading infected files or accidentally leaking usernames and passwords to sites they thought they could trust. Another example is evidence tampering. Imagine an employee strategically deleting incriminating emails or files — keeping these objects out of the reach of the legal, compliance or HR departments. 4. External Security Threats Malware and viruses, like ransomware, have done serious damage to organizations across the globe. Not only is company reputation at risk, but the privacy and security of internal and customer data as well. External threats can sneak in through emails and attachments, and it isn’t always enough to educate users on what to look out for — especially when the infected messages seem so compelling. Exchange Online’s limited backup/recovery functions are inadequate to handle serious attacks. Regular backups will help ensure a separate copy of your data is uninfected and that you can recover quickly. 5. Legal and Compliance Requirements Sometimes you need to unexpectedly retrieve emails, files or other types of data amid legal action. Microsoft has built in a couple safety nets, (Litigation Hold) but again, these are not a robust backup solution capable of keeping your company out of legal trouble. For example, if you accidentally delete a user, their on-hold mailbox, personal SharePoint site and OneDrive account is also deleted. Legal requirements, compliance requirements and access regulations vary between industries and countries, but fines, penalties and legal disputes are three things you want to avoid. 6. Managing Hybrid Email Deployments and Migrations to Microsoft 365 Organizations that adopt Microsoft 365 typically need a window of time to serve as a transition window between on-premises Exchange and Microsoft 365 Exchange Online. Some even leave a small portion of their legacy system in place to have added flexibility and additional control. These hybrid email deployments are common yet pose additional management challenges. The right Microsoft 365 backup solution should be able to handle hybrid email deployments, and treat exchange data the same, making the source location irrelevant. Conclusion