Data Recovery from Ransomware Attack

Those who stand behind ransomware attacks are usually very scammers with experience in computer programming. As a rule, ransomware infects your computer via an email attachment, a network, or an infected browser.

Ransomware is a type of malware that encrypts or otherwise locks users out of their files. When users try to access their data, they receive a notice demanding the payment of a ransom to regain its use. Around since the 1980s, the last decade has seen various ransomware trojans crop up, but the real opportunity for attackers has ramped up since the introduction of Bitcoin. This cryptocurrency allows attackers to collect money from their victims without going through traditional channels.

The word ransom comes from English and means ransom and is therefore also called extortion software. In many cases, experts also speak of encryption trojans, since the extortion is based on the fact that the data is inextricably coded and inaccessible to the user. Ransomware fights itself into the system and the user usually notices in shock and contagious panic that its system is no longer accessible.

Figures from Datto show that ransomware costs businesses on average, $75 billion a year; this includes the ransom itself, subsequent recovery efforts, organizational and IT initiatives to protect the organization from further attacks, as well as downtime, forensic investigation, training costs, restoration, and loss of revenue/productivity. More conservative estimates by Cybersecurity Ventures places ransomware damage at more than $11.5 billion in 2019, which is a startling rise from a modest $325 million four years ago. Whether the figure is $75 billion or $11.5 billion, the devastation is very real to those experiencing ransomware. In May of 2019, for example, the City of Baltimore was shut out of government systems for over a month. Vital systems for vaccine production, ATMs, airports, and hospitals were all impacted. Although the ransomware demand was $76,000, the recovery price tag amounted to nearly $20 million.

Ransomware is malware that blocks the operating system or entire server or encrypts existing data. The perpetrators are squeezing their victims by making clear that the data has only been released and made available after a ransom payment.

The extension hardly distinguishes itself from the other malicious programs: for example, manipulated websites, a link from a spam email or an existing message about a social network and embedding them in a system. In many cases, the perpetrators send emails that contain a suspected delivery note or collection debt. In truth, the attached file does not contain any relevant information, except the damage code.

Ontrack’s investment in the development of specialized software allows us to recover data from ransomware-encrypted systems, virtual machines, backup files, tapes, and other storage media.

Ransomware incidents vary on the type of payload, and data recovery can be complex. Ontrack provides the best possible solutions for data recovery success.