Restore after ransoware

[VictorVLab]

Hi all,
Last week I was attacked by a ransomware. All servers with shared folders were affected.
A fileserver with windows 2016, the only one not VM, on a old dedicated server, has suffered more.
Crackers has get entered the server and all data was crypted veeam agent was uninstaled and all backup files were deleted. I have restored them via a data recover software and in another machine tried to recover files wich I need but seems corrupted. Another problem is that it see a only backups of about 1 year old but it have versions till 19.02
Someone faced similar problems?
Any suggestions?
Any help will be appreciated.
Thanks

[Gostev]

Hello!

You should open a support case for assistance with recovery. We have the dedicated SWAT team that specializes on this, they will see if any data can be salvaged from those backups (sounds like a data recovery software didn't restore them correctly).

As for suggestions, you should always keep an offline (or immutable) copy of your backups. Otherwise, if hackers can take over your environment, they can easily destroy all data that is online.

Most smaller customers use rotated hard drives, and larger customers use tape or object storage. Also, if you use Veeam Backup & Replication (and not just standalone agents), then with v11 you can set up a hardened repository that supports immutable backups.

Thanks!