UK housing association avoids disaster and ransom with Veeam and Covenco

The business challenges

Cyberattacks on nonprofit organizations — and housing associations in particular — are increasing in sophistication and scale. However, 80% of nonprofits don’t have a policy in place to address cyberattacks, and 24% of housing associations suffered at least one attack between 2020 and 2021.

Housing associations are targets for several reasons. They hold residents’ personal data, they’re connected to public-sector organizations that maintain financial data, and they operate within limited budgets that often can’t fund business continuity and disaster recovery (BCDR) strategies.

A housing association in the south of England didn’t let a limited budget get in the way. When the IT team grew concerned that legacy backup might not protect against a cyberattack, the team contacted Covenco Recovery Services, an established IT company that provides Backup as a Service (BaaS) and Disaster Recovery as a Service (DRaaS) to UK companies and nonprofit organizations.

“We told them when it comes to a cyberattack, you should always plan for the worst,” said Gurdip Sohal, Sales Director at Covenco Recovery Services. “We also explained that attackers will have less to leverage if you’ve been backing up to our cloud and supplement that by using our Tape-out Service to provide a complete air-gapped offline copy of your data.”

Covenco recommended Veeam Backup & Replication for proactive data protection. A feature called Veeam Cloud Connect provides a fast, easy and secure way to back up to Covenco’s cloud.

“When ransomware hit a few years later, the housing association wasn’t crippled like they might have been if they hadn’t been backing up to our cloud,” Sohal said. “Their business didn’t stop, their residents weren’t impacted, and they didn’t pay ransom. They had complete visibility and control of their data.”

The solutions

Veeam and Covenco proactively prevented the housing association from suffering a major disaster and debilitating downtime following the cyberattack. In addition, Veeam and Covenco enable air-gapped backups for mastery of the 3-2-1-1-0 Rule, and they offer additional ransomware protection through immutable backups.

The cyberattack took place on the first day of the UK’s first Coronavirus lockdown. Covenco discovered the housing association’s cloud backup repository had been deleted and immediately contacted the association, which quickly determined an unknown external entity had been systematically deleting backup jobs. The association shut down its network straightaway to prevent additional deletions.

Fortunately, Veeam Insider Protection places deleted backups in a recycle bin for redundancy. Covenco returned the deleted backups to the cloud repository so the housing association could restore lost data.

“Veeam helped us proactively prevent a major disaster by protecting backups stored in our cloud from deletion,” Sohal said. “The housing association recovered their data without paying ransom.”

As a result of the incident, the housing association opted for additional protection. Veeam copies backups to tapes, and Covenco stores them on-premises and off-premises. Covenco’s tape service not only provides an offsite of backups, but it also provides an offline copy to ensure backups are fully air gapped.

Since air-gapped backups are offline and inaccessible, the housing association masters the 3-2-1-1-0 Rule (3 different copies of data on 2 different media where 1 copy is offsite, 1 copy is air gapped, immutable or offline and there are 0 recovery errors). Next the housing association is considering immutable backups to boost ransomware protection. Veeam creates a hardened Linux repository that protects against malicious intent or deletion of data on the local backup repository.

In the meantime, Veeam backs up 10 TB across 50 VMware vSphere virtual machines to Covenco’s cloud. Sohal said Veeam may eventually back up the housing association’s 220 Exchange Online mailboxes to Covenco’s cloud as well. Veeam Backup for Microsoft Office 365 provides comprehensive data protection to ensure complete access and control of data.

“A big misconception is that Office 365 already resides in the cloud, so there’s no reason for a backup, but that’s not true,” Sohal said. “Veeam backs up O365 data on-premises for our customers or directly to our cloud, and a self-service portal makes recovery fast and easy.

“Veeam provides the best comprehensive backup technology, and we provide the best BCDR services,” Sohal continued. “Together we provide complete data protection, security and peace of mind.”

The results

• Proactively prevents a major disaster and debilitating downtime
  The power of Veeam technology combined with Covenco’s skills, expertise and knowledge protects petabytes of data for thousands of customers.
• Enables air-gapped backups for mastery of the 3-2-1-1-0 Rule
  Veeam is storage neutral; therefore, it supports backup to disk, tape and cloud, enabling Covenco’s customers to choose whatever form of backup copy works best for them.
• Offers extra ransomware protection through immutable backups
  Veeam helps keep backups safe in immutable, hardened Linux repositories that prevent encryption and accidental or malicious deletion from ransomware.