Escaping extortion: ECDoE foils a ransomware attack fast with Veeam

Thousands of schools located in the Eastern Cape, the second largest province in South Africa, depend on ECDoE for essential services such as implementation of the national curriculum and examinations, teacher development, distribution of the provincial budget, digital and e-learning initiatives, and more. Recently, the ECDoE ICT team turned its attention to strengthening data resilience.

“We serve many rural schools with limited resources, so getting technology to them and upskilling the on-site staff is an ongoing challenge,” said Cecil Swartz, Deputy Director of Information Systems at ECDoE. “After a lot of hard work, we finally reached the stage where we could start thinking about data resilience and the measures we had in place to protect users from disruption.”

With cybercriminals increasing their attacks on the education sector, ECDoE is always looking to bolster its protection.

“No industry is safe from cyber attackers, but we felt especially vulnerable because we don’t have big business budgets and we hold lots of sensitive data,” said Swartz. “We’re also subject to yearly checks from the Auditor General (AG) of South Africa who evaluates our data governance and compliance. Our goal was to raise the bar on data resilience without overloading the relatively lean ICT team.”

ECDoE enabled enterprise-class data resilience for thousands of schools and hundreds of thousands of users with Veeam. The ICT team compared Veeam to a few solutions including Acronis Backup and Recovery.

“A PoC revealed that Veeam would be by far the easiest solution to implement, manage, and scale,” said Swartz. “We calculated that the total cost of ownership would be very low, both because of the pricing and the limited resources we would need to dedicate to managing it long term.”

Today, ECDoE relies on Veeam to protect data across a hybrid environment, comprising of on-premises infrastructure, Microsoft Azure cloud-hosted systems, as well as Microsoft 365 and Microsoft Entra ID SaaS platforms.

“We’ve now moved 80% of our IT environment into the cloud, and Veeam has come on that journey with us,” said Swartz. “Veeam works with whatever platform you choose — you simply point it at the data, and it backs it up seamlessly. In fact, Veeam has helped us gain a true picture of our IT environment. Using Veeam, we found out that we have three times as many users than we thought we did, and almost ten times as many active mailboxes. That visibility has been invaluable for our planning.”

The investment in Veeam proved a smart choice when ECDoE used its new data resilience capabilities to thwart a ransomware attack. The attackers locked the organization out of the system that tracks student attainment and attendance, which is crucial to school operations and student wellbeing.

“The attackers demanded that we pay Bitcoin to regain access, but I was able to say don’t worry, we’ll use Veeam to recover from our backups to a safe state,” said Swartz. “It was a huge relief and a massive win, especially when we couldn’t trust that the attackers would unlock our systems or that they wouldn’t carry out another attack if we paid the ransom. We got our major workloads back online within a couple of days, before taking around 2.5 weeks to restore everything else carefully, checking systematically for signs of ongoing compromise.”

ECDoE is now working with the AG to assure them that the new data recovery speeds enabled by Veeam are not too good to be true.

“We can recover data in one click with Veeam, which is a dramatic difference to the time and effort it used to take when we backed up to tape,” said Swartz. “Our users are happier because we minimize disruption to their work, and we’re helping the AG see that we really can recover data that fast, and there is no need for manual backup checks, all because of Veeam.”

With new automation and monitoring provided by Veeam, ECDoE is improving operational efficiency alongside data resilience. By stepping up from Veeam Backup for Microsoft 365 and Veeam Backup for Microsoft Entra ID, the on-premises software versions, to the Veeam Data Cloud equivalents, which are SaaS solutions, the organization’s ICT team’s load is lighter than ever.

“Since moving to Veeam Data Cloud, we’ve been able to reduce the team dedicated to managing data resilience from six people to one,” said Swartz. “With Veeam, our data has never been more accessible or less at risk of loss or compromise. As we look to offer the best possible education to the children of the Eastern Cape, Veeam delivers the data resilience we need to succeed.”

• Strengthens cyber-resilience by enabling comprehensive recovery
  “We used Veeam to recover essential workloads within a couple of days and our entire environment within 2.5 weeks following a ransomware attack,” said Swartz. “Veeam gave us the freedom to rise above cybercriminals’ demands.”
• One-click data recovery boosts user productivity
  “Our users are happier because we minimize disruption to their work, and we’re helping the AG see that we really can recover data that fast, and there is no need for manual backup checks, all because of Veeam,” said Swartz.
• Cuts data resilience management workload by 6x
  ECDoE has now outsourced management of Microsoft 365 and Microsoft Entra ID data resilience to Veeam, allowing it to focus on its central mission of delivering high-quality education.