How to Recover from a Ransomware Attack in Office 365
Following on from our recent article SaaS Applications Are Not Safe From Ransomware its clear that whilst the likes of WannaCry targets older versions of Windows such as XP and Server 2003 most strains of Ransomware actually start in Excel and Word. Whether they are on premise or in the Cloud (Office 365) the ransomware can easily spread, If your using Office 365 then ActiveSync and OneDrive Sync allow it to spread easily. The only way you can be certain of recovery from a Ransomware attack in Office 365 is by ensuring you have a full backup of the Cloud based data.
So you’ve been hit by ransomware, lets discuss how you can recover your Office 365 data.
Step 1: Unplug
As soon as ransomware is detected on a system, remove it from the network immediately. Unplug and network cables and disable any wifi connections to Isolate the device and stop it infecting other systems.
With Office 365 also ensure that any syncing tools such as OneDrive Sync are disabled to prevent any ransomware from spreading to OneDrive.
Step 2: Remove the Ransomware
Before we can begin restoring files we need to be sure that the strain of Ransomware is removed from any affected computers or servers to ensure no further damage is caused once the files are restored.
Run a complete full system scan with your companies security software or use a tool such as Microsoft’s Malicious Software Removal Tool.
Step 3: Restore From A Backup
The only real protection from Ransomware is an unaffected offsite copy of your data. If you know the data is backed up recovery is easy.
Our Office 365 backup service offers easy recovery of your Office 365 Data, Either a single file or folder or a whole account. Simply select a point in time prior to the ransomware infection and your original unlocked files will be restored all through an easy to use web based interface.
Step 4: Post-mortem
Once the dust has settled and the Ransomware has been removed with files fully restored take a step back and assess how your organisation was infected and what controls and procedures can be implemented to ensure your data is safe in the future.
To learn more how our Office 365 Backup service can protect your data click here.