FROM RANSOMWARE TO

RESILIENCYHow IT leaders kept their businesses runningwith modern data security and management

Introduction

Ransomware
readiness is moreurgent than everGartner reportsthat by 2025,75%of IT organizations
will face one ormore attacks1

Ransomware is the fastest-growing type ofcybercrime.
Gartner reports that by 2025, 75% of IT organizations will face one ormore attacks. And every time a cybercriminal succeeds, the organizationis damaged—financially and often reputationally. By 2031, ransomware
is expected to attack a business, customer, or device every two seconds,
costing victims around $265 billion annually, according to Cybersecurity
Ventures. No industry is immune. Despite concerted efforts to thwart
ransomware attacks, businesses can’t let their guard down—and
here’s why. Cybercriminals are innovative. They continue to create new
attack vectors. And their attacks are becoming more frequent, moresophisticated, and more targeted. But though the contours of eachattack may be unique, attackers all have the same goal: to disrupt
business operations so victims will pay to restore order.
With so much at stake, enterprises must evolve their security
posture—and start prioritizing data security along withperimeter and access security.

True preparedness must also include:• Reducing the attack surface• Planning and practicing your response through tabletop exercises• Determining how you’ll know what data was compromised and the risk level to contain potential
damage• Increasing visibility across all data environments—because you can’t secure data you can’t see
or manage

When it comes to ransomware readiness, being proactive is key.

1. “Minimize Risk by Better Knowing and Managing Your Data,” Gartner IT
Infrastructure, Operations & Cloud Strategies Conference, Nov 2022

2©2024 Cohesit y. All rights reser ved.

Over view

Hear fromcustomers,
security partners,and leading
security experts
Fortunately, there ARE best practices andsolutions to improve your security posture—and perhaps even defeat cybercriminals.
We’re a trusted partner with modern data security andmanagement solutions fit for this new era. And we’d like
you to hear directly from those we serve.

In this eBook, our customers describe:

Their experiences with

Their insights into theHow they recovered

How they strengthened

ransomware attacks

anatomy of a breachsuccessfully

their security posturefor the future

Finally, you’ll hear from partners in our Data Security Alliance and the Cohesity Security Advisory
Council. These experts—a true ‘who’s who’ of cybersecurity—highlight key ways to win the war
on ransomware.

3©2024 Cohesit y. All rights reser ved.

Spring Independent School District

INDUSTRY: EDUCATIONLOCATION: HOUSTON, T X
FOUNDED: 1935

School district’s prep pays off
BACKGROUND:Like school districts everywhere, Houston-area Spring Independent School
District (ISD) has been strengthening defenses against growing
cybersecurity threats.
“We block 1.4 million attacks every month, do regular vulnerability and penetration
testing, and offer year-round cybersecurity training to staff,” says Bobby LaFleur,director of Application Support.
Plus, a neighboring Houston school district was hit by a disruptive ransomware
attack in March 2020 and paid over $200,000 in ransom.
Spring ISD didn’t want to suffer the same fate.

4©2024 Cohesit y. All rights reser ved.

Spring Independent School District

THE ATTACK:In November, LaFleur’s vigilance and preparation paid off.
“We got a call around 8:00 p.m. about errors occurring in our systems we wereusing during the pandemic,” LaFleur said. When IT engineers recognized that fileservers were being encrypted, LaFleur and his colleagues rushed to the office totemporarily shut down the network.

THE RECOVERY:

Fortunately, Spring ISD had recently made an important switch.
They’d previously used multiple backup products: Veeam and Idera, two different server platforms, with the whole
setup replicated in a nearby co-location facility used for disaster recovery. But when the co-lo lease had comeup for renewal, the IT team turned to us. Our backups in the data center locations are immutable, preventing
attackers’ attempts to encrypt or delete them. “If any virtual machine or SQL Server is encrypted in an attack,”
LaFleur says, “we can instantly restore a snapshot to any point in time.”
When the attack hit, the Cohesity data security and management platform was already in place. SpringISD had stored one immutable copy of virtual machines (VMs) and databases on-premises and anotheron AWS. The day after the attack, even before school started, the IT team had already restored
its Active Directory servers and critical learning servers. Finance and the Student Information
Systems were restored within two days. No disruption to learning. No impact on payroll. No
ransom paid. The remaining 200 servers—mostly secondary systems—were brought backonline in a planned manner.

“Ransomware protection helped us get favorable rates
when we renewed and increased our cybersecurity
insurance. When peers in other school districts
ask what we use for data protection,
I tell them it’s Cohesity—andI’m very satisfied with ourchosen partner!”
Bobby LaFleur, director ofApplication Support, Spring
Independent School District

5©2024 Cohesit y. All rights reser ved.

“Spring Independent School District

After the ransomware attack, Cohesity really saved
the district. Though our local Active Directory servers
were locked up, preventing us from restoring datafrom the local backup, we were able toquickly restore critical servers
from Cohesity backups inAWS. Teachers taught
online classes the very
next day as usual, andwe didn’t miss payroll.”
Bobby LaFleur
Director of Application Support
Spring Independent School District

THE RESULTS:$0 ransom
paid

100% recovery

Favorable
cybersecurity
insurance rates

6©2024 Cohesit y. All rights reser ved.

Sk y Lakes Medical Center

INDUSTRY: HEALTHCARELOCATION: KL AMATH FALLS, OR
FOUNDED: 1968

Data security andrecovery can save lives
BACKGROUND:

Sky Lakes Medical Center is a not-for-profit teaching hospital serving morethan 80,000 people in south-central Oregon and northern California.
As the renewal of its aging Commvault legacy backup product neared, theSky Lakes Information Services (IS) team evaluated new data security
and management solutions that were easier to use and would drive
further efficiencies. Little did they know that our security and ransomware
protection capabilities were going to be lifesaving, not only in terms ofpatient care, but also for the IS team.

7©2024 Cohesit y. All rights reser ved.

Sk y Lakes Medical Center

THE ATTACK:In October 2020, Sky Lakes wasunexpectedly targeted and breached
by a massive ransomware attack.
The regional healthcare leader was attacked by the Ryukransomware variant, which impacted 70% of Sky Lakes IT
operations, including their legacy backups.

THE RECOVERY:

We served on a rapid-response data management team for Sky
Lakes as it defended its data against ransomware.
Our immutable backup snapshots, DataLock, and other built-in
protections that deter, detect, and rapidly recover data at scalefrom a ransomware attack empowered the IS team to say no to
the cybercriminals’ demands.
Through the Cohesity data security and management
platform, we were able to give IS staff access to a granularversion of the organization’s Active Directory database.
Sky Lakes was also able to instantly restore its fileservices thanks to our unique Cohesity SmartFiles
capabilities. Fast, simple data restores enabledmany patients who regularly rely on the Sky
Lakes Cancer Treatment Center to minimize
disruption in their treatments without being
inconvenienced or sent elsewhere. “In thiscase, it’s not an exaggeration to say thatCohesity saved lives,” explains Nick Fossen,manager of Technology Solutions at Sky Lakes.

“Cohesity helps us to put
ransomware extortionists
out of business.”
John Gaede, director of Information
Systems, Sky Lakes Medical Center

8©2024 Cohesit y. All rights reser ved.

“Sk y Lakes Medical Center

Our organization suffered a critical ransomware
attack, effectively crippling our entire infrastructure.
With Cohesity, we’ve been able to recover machines
and file shares, verify they’re clean, and bringthe applications back online.
Cohesity has literally saved us
hundreds of hours of workand I’d say it prevented usfrom having to actually
pay the ransom note.”
John Gaede
Director of Information Systems
Sky Lakes Medical Center

THE RESULTS:

9$0 ransom

No data

100s of hours saved

paidlostfor data restores©2024 Cohesit y. All rights reser ved.

Origin Propert y

INDUSTRY: REAL ESTATELOCATION: BANGKOK, THA IL AND
FOUNDED: 2009

Refusing the ransom
and restoring data fast
BACKGROUND:

Thailand’s Origin Property Public Company Limited, a real estatedevelopment firm managing numerous properties across Thailand,
had been relying on a legacy solution for data protection and recovery.
In 2022, the IT team decided to look for a new data security and management solution to help
reduce backup times, improve data security, simplify scalability, and recover rapidly as they
continued to expand.
“We store many different types of data, including our enterprise resource planning (ERP)
software, customer databases, development data, and other core business applicationsat our company-owned facilities,” explained Sirawut Chanthasangsawang, senior vicepresident of System Information Technology. “If we ever lost any of that data, it
could be catastrophic for our company.”

10©2024 Cohesit y. All rights reser ved.

Origin Propert yTHE ATTACK:

While the team was actively researching a
new solution, ransomware struck, the existing
solution failed, and all of Origin’s databases,servers, and applications came to a standstill.
“Ransomware was attacking our primary storage by using
an API to completely delete all of our volumes,” explained
Chanthasangsawang. “The intruders were encrypting all of ourdata repositories from our previous backup software, making
them completely unusable for recovery. We would have been
unable to recover unless we paid their ransom demands.”

THE RECOVERY:

Luckily, Origin had initiated a proof of concept (PoC) with us.
Since Origin had backed up its data onto the Cohesity data security and management
platform during the PoC, Origin was able to protect and restore all their customer andenterprise data within three hours—and avoid paying the ransom.
Since then, we’ve enabled Origin to shorten data backup windows from 20 hours tojust under three hours, an improvement of 85%. In addition to a stronger security
posture, our solution has also resulted in a much lower TCO than the previous
vendor’s data protection software.

“Cohesity was absolutely instrumental inrecovering and restoring our entire
environment. Without Cohesity,
we would have ended up
paying the ransom to get ourdata back.”
Sirawut Chanthasangsawang, SVP ofSystem Information Technology,
Origin Property

11©2024 Cohesit y. All rights reser ved.

“Origin Propert yCohesity’s instant recovery enabled
us to retrieve all of our data fromthe ransomware attack in under
three hours. WithoutCohesity, we wouldhave had to pay
the ransom to getour data back.”
Sirawut Chanthasangsawang
SVP of System Information TechnologyOrigin Property

THE RESULTS:

12$0 ransom

Data restored

No datapaid

in 3 hours

lost©2024 Cohesit y. All rights reser ved.

SiteOne Landscape Supply

INDUSTRY: RETA IL
LOCATION: ATL ANTA, GA
FOUNDED: 2013

Distributor resumes
operations 24 hours
after cyberattack
BACKGROUND:

SiteOne Landscape Supply is a $3.5 billion, Fortune 1000 company
based in Atlanta.
With over 600 locations in the U.S. and Canada, it has seen heavy growth throughacquisitions—and a doubling of its revenue—in the last five years.

13©2024 Cohesit y. All rights reser ved.

SiteOne Landscape Supply

THE ATTACK:At 3 a.m. on July 14, 2020, David Bannister, vicepresident of Technology Services, was awakened by one of his senior
engineers who feared an attack on its information technology systems.
The environment was completely out, and the IT team was unable to reach internal servers orservices. SiteOne launched an investigation, notified law enforcement, engaged legal counsel
and other incident response professionals, and quickly implemented a series of containmentand remediation measures to prevent the ransomware from spreading.

THE RECOVERY:

SiteOne recovered all critical operational data and prevented a significant impact on
business operations.
•File shares on the Cohesity data security and management platform were restored in minutes.

•We restored VMs to a point in time before the incident—and isolated the data in a lab environment to identify
what activities were taking place before and during the encryption event.

•Pre-production environments had numerous services without real-time data replication.
Recovery of these systems with us was instrumental in reestablishing business operations.

•SiteOne had hot and warm standby copies of data for core applications and services,
including numerous proprietary and custom applications.

“Cohesity snapshot views proved instrumental and provided deep insight to ourforensic teams, as well as enabled SiteOne to determine what steps were needed
to meet regulatory requirements,” Bannister said. “Having the ability with Cohesity
to paint a complete picture of the ransomware attack helped us move forward
and identify next steps not only for IT and Security teams, but our Legal andCommunications departments. Without our Cohesity views, we would not havebeen as equipped to rapidly investigate and perform the needed forensic
activities.”“Without the ability to freeze and lock our backups withCohesity DataLock, we could not have recovered our dataas quickly following the cyberattack.”
David Bannister, VP of Technology Services,
SiteOne Landscape Supply

14©2024 Cohesit y. All rights reser ved.

“SiteOne Landscape Supply

With Cohesity, we were able to beback up and running in 24 hours,and within a week our data was
fully restored by our internal teams
without having to decryptanything.”

David Bannister
VP of Technology Services
SiteOne Landscape Supply

THE RESULTS:

15$0 ransom

Up and runningNo need for data

paid

in 24 hours

decryption©2024 Cohesit y. All rights reser ved.

Conclusion

The critical needfor collaboration
We recognize we can’t fight the ransomware
scourge in isolation.
Ecosystems can be a force multiplier. That’s why we formed
the Data Security Alliance, partnering with the ‘who’s who’of cybersecurity and bringing together the brightest minds
and boldest solutions for a comprehensive security, dataprotection, and resilience strategy.

Data Security
Alliance

16©2024 Cohesit y. All rights reser ved.

Data Securit y Alliance“ Most folks in the security industry will recognize that none of us cansolve problems for our customers ourselves. We have to work
together and it’s a key part of our platform at Tenable.
By partnering with Cohesity and other industry
leaders, we round out the ability for ourcustomers to assess their attack surface,and enable customers to prioritize andfocus on the most critical risks forexposure and cybersecurity.”

Ray Komar, vice president of Technical Alliances“ We continuously work to ensure that organizations
with their endpoints, workloads, and users
continue to operate without obstacles,
while data is continuously secured
against breaches and insider
threats, including ransomware
exfiltration.”

Michael Rogers, vice president of Global Alliances

17©2024 Cohesit y. All rights reser ved.

Securit y Advisor y Council

We also created the Cohesity Security Advisory Council, bringing together
visionaries with deep security expertise from a host of companies, including
Mandiant, Netflix, Facebook, Microsoft, and the National Security Agency.
Led by Cohesity Board Member Kevin Mandia, the Council advises the Cohesity team, customers, andpartners on security trends and emerging cyber threats and vulnerabilities.

“ We’ve recently witnessed an explosion of vicious

ransomware attacks where cybercriminals are getting
smarter, often seizing legacy backups in aneffort to paralyze companies and force
payouts. Data security and data
management leaders must
work hand-in-hand to keep
bad actors in their place.”
Kevin Mandia, CEO

At Cohesity, we’re proud to offer customers our modern data security andmanagement platform—and the combined benefits of our collaborative,
ecosystem approach.

Let’s fight ransomware together.
18©2024 Cohesit y. All rights reser ved.

© 2024 Cohesit y, Inc. All rights reser ved.
Cohesit y, the Cohesit y logo, SnapTree, SpanFS, DataPlat form, DataProtec t, Helios, the Helios logo, DataGovern, SiteContinuit y,
DataHawk, and other Cohesit y marks are trademarks or registered trademarks of Cohesit y, Inc. in the US and/or internationally.
Other company and produc t names may be trademarks of the respec tive companies with which they are associated. This material (a)is intended to provide you information about Cohesit y and our business and produc ts; (b) was believed to be true and accurate at thetime it was writ ten, but is subjec t to change without notice; and (c) is provided on an “A S IS” basis. Cohesit y disclaims all express or
implied conditions, representations, warranties of any kind.

Cohesity.com | 1-855-926-4374 | 300 Park Ave., Suite 1700, San Jose, CA 95110

6100020 - 002 EN 2-2024