A medium-sized Italian telecommunications company suffered an attack by Akira ransomware that compromised part of its Microsoft Hyper-V infrastructure, making file servers and databases used across different areas of the organization inaccessible.
The affected systems stored customer information, technical documents, contracts, internal records, billing-related data, and information used by business applications.
Although the company had backups, the available restore points did not contain all the recent information required. Relying solely on the backups would have meant losing a significant amount of operational data produced before the attack.
In this situation, Digital Recovery was engaged to recover information directly from the compromised systems.
Akira attack compromises servers and databases
The incident affected both file servers and databases within the Hyper-V environment.
When Digital Recovery began the project, the company’s priority was to recover the data needed to restore its operations.
The attack affected administrative, technical, and customer service activities. Employees temporarily lost access to shared documents, historical records, and information used by internal systems.
At the same time, the IT team was working to rebuild a secure infrastructure. However, recreating the servers did not solve the main problem: the data previously used by the company remained inaccessible.
Recovery was organized around data priorities
Digital Recovery structured the project according to the importance of each information set to the business.
Essential databases and directories were prioritized, followed by operational documents and customer-related information. Historical and less urgent data was processed later.
This strategy was essential because the importance of data was not always related to the volume stored. A small database could support a critical application, while a much larger server might contain mainly historical files.
Recovery also required different approaches for file servers and databases, including specific validation procedures to ensure that the recovered information could be used again.
Progressive deliveries supported the resumption of operations
The recovered data was made available progressively for validation.
This enabled the IT team to begin restoring important applications and processes while other recovery stages were still underway.
The prioritized databases enabled the gradual resumption of internal systems, while documents, technical records, and shared files became available again to operational teams.
From the start of the project to final approval of the recovered data, the process took approximately two to three weeks.
Ransomware recovery requires business prioritization
This case demonstrates that post-ransomware recovery should not be evaluated solely by the number of files recovered.
In complex corporate environments, certain databases or information sets may be far more important to business continuity than large volumes of historical files.
By combining experience in recovering virtualized environments affected by ransomware with a strategy based on data priority and usability, Digital Recovery helped the Italian company recover essential information and gradually move forward with restoring its operations after the Akira attack.
