Ransomware hits Rompetrol gas station, how tough it is for organizations to secure data?

On March 6, ransomware HIVE hits Rompetrol, the large gas station service provider in Romania for a $2 million ransom, causing huge impacts on the company’s IT services. Rompetrol faced a complex cyber attack, their social media read.

Rompetrol is the supporting oil station operator for Petromidia Navodari, the largest oil refinery in Romania, with an annual oil processing capacity of more than 5 million tons. Its parent company KMG International operates businesses including oil refining, marketing, trading, production, along with a series of oil industry services including drilling, EPCM (design procurement and construction management), and transportation, owning customers in 15 countries across Europe, North Africa, and Central Asia.

Due to the misfunction of Rompetrol’s official website and applications caused by the ransomware attack, customers could only able to pay by cash or credit cards. A $2 million ransom request was made by HIVE team for the company to exchange the safety and availability of data. Rompetrol’s Fill&Go app and the official websites of both KMG and Rompetrol were still under the state of collapse by March 8.

It’s not a rare case for organizations to be a cyberattack victim in recent years, since the chances for today’s ransomware or other malware to easily seize a tiny weak point in your IT infrastructure can be higher than you can imagine. Just take HIVE this time for an example, its changeable exploit strategies and techniques often make it difficult for victims to shield their IT systems on their own. Therefore, establishing a data protection plan ahead of time under the help of up-to-date backup software with solid functionality is essential.

How to minimize impacts caused by ransomware attacks

No matter your data center is built upon physical servers or virtualization, the famous 3-2-1 backup strategy is never too old to help you out of a jam, at least you will have most backups kept in offsite or cloud storage, even if ransomware hijacks both of your on-premises production environment and backup storage, data is still recoverable.

l  3: Create three copies of data

l  2: Save backups in two storage media

l  1: Keep one offsite backup copy

For virtualization users, software like Vinchin Backup & Recovery can help streamline the whole process, providing a wide range of features to simplify the construction of backup architecture that’s workable for effective disaster recovery. Experienced in protecting the ICT infrastructure of many organizations, including PetroChina in the oil and gas industry, Vinchin Backup & Recovery carries its own anti-ransomware philosophy.

How Vinchin Backup & Recovery works against ransomware

By providing a series of problem-oriented backup and disaster recovery features, Vinchin Backup & Recovery helps organizations reduce the risk of becoming a hostage of ransomware from source based on 3-2-1 backup strategy compliance.

Anti-ransomware Backup Storage

When using Vinchin Backup & Recovery for frequent VM backups, Storage Protection can be enabled to prevent backup data in backup repository from harm. Based on real-time I/O monitoring, any data modification request by unauthorized applications will be directly denied, ensuring critical VM backups can only be accessed by Vinchin backup server.

Offsite Backup Copies 

Vinchin Backup & Recovery provides Offsite Backup Copy to help you build your own disaster recovery center. Vinchin Encrypted Backups technique will encrypt initial backup data with bank-level algorithm, and the later offsite backup copies will be created based on the encrypted backups, making sure the safety of your backups during data transfer process. Even if both local production environment and backup storage become unusable, offsite backup copies can be quickly recovered to either local or remote center for fast business restore.

 Cloud Archive

You can easily have important backup copies archived to cloud with Vinchin Backup & Recovery. Multiple cloud object storage including AWS S3, Azure Blob Storage, and Wasabi Hot Cloud Storage are supported. When ransomware makes an unexpected visit, the cloud archive data is another available choice for you to implement disaster recovery. Once being transferred to on-premises backup storage, you can use the archive data either for quick full VM restore or instant restore to guarantee business continuity in a very short time.

Facing with dynamically changing issues brought to data security by the evolution of cyberattacks, an advanced disaster recovery plan can always be the strongest firewall, turning anti-ransomware from complex to simple.