UK Housing Association Avoids Disaster and Ransom

Housing Associations Background

Housing associations provide affordable homes for millions of people in need throughout the United Kingdom. One particular housing association located in the south of England manages nearly 5,000 properties, giving low-income individuals, older adults, and people with disabilities the opportunity to live in quality homes they can afford.

The business challenges

Cyberattacks on non-profit organisations — and housing associations in particular — are increasing in sophistication and scale. However, 80% of non-profits don’t have a policy in place to address cyberattacks, and 24% of housing associations suffered at least one attack between 2020 and 2021.

Housing associations are targets for several reasons. They hold residents’ personal data, they’re connected to public-sector organisations that maintain financial data, and they operate within limited budgets that often can’t fund business continuity and disaster recovery (BCDR) strategies.

A housing association in the south of England didn’t let a limited budget get in the way. When the IT team grew concerned that legacy backup might not protect against a cyberattack, the team contacted Covenco, an established IT company that provides Backup as a Service (BaaS) and Disaster Recovery as a Service (DRaaS) to UK companies and non-profit organisations.

“We told them when it comes to a cyberattack, you should always plan for the worst,” said Gurdip Sohal, Sales Director at Covenco. “We also explained that attackers will have less to leverage if you’ve been backing up to our cloud and supplement that by using our Tape Out Service to provide a completely air-gapped offline copy of your data.”

The Veeam solutions

Covenco recommended Veeam® Backup & Replication™ for proactive data protection. A feature called Veeam Cloud Connect provides a fast, easy and secure way to back up to Covenco’s cloud.

“When ransomware hit a few years later, the housing association wasn’t crippled like they might have been if they hadn’t been backing up to our cloud,” Sohal said. “Their business didn’t stop, their residents weren’t impacted, and they didn’t pay the ransom. They had complete visibility and control of their data.”

The result

Veeam and Covenco proactively prevented the housing association from suffering a major disaster and debilitating downtime following the cyberattack. In addition, Veeam and Covenco enable air-gapped backups for mastery of the 3-2-1-1-0 Rule, and they offer additional ransomware protection through immutable backups.

The cyberattack took place on the first day of the UK’s first Coronavirus lockdown. Covenco discovered the housing association’s cloud backup repository had been deleted and immediately contacted the association, which quickly determined an unknown external entity had been systematically deleting backup jobs. The association shut down its network straightaway to prevent additional deletions.

Fortunately, Veeam Insider Protection places deleted backups in a recycle bin for redundancy. Covenco returned the deleted backups to the cloud repository so the housing association could restore lost data.

“Veeam helped us proactively prevent a major disaster by protecting backups stored in our cloud from deletion,” Sohal said. “The housing association recovered their data without paying the ransom.”

As a result of the incident, the housing association opted for additional protection. Veeam copies backups to tapes, and Covenco stores them on-premises and off-premises. Covenco’s tape service not only provides offsite backups but also provides an offline copy to ensure backups are fully air-gapped.

Next steps

Since air-gapped backups are offline and inaccessible, the housing association masters the 3-2-1-1-0 Rule (3 different copies of data on 2 different media where 1 copy is offsite, 1 copy is air-gapped, immutable, or offline and there are 0 recovery errors). Next, the housing association is considering immutable backups to boost ransomware protection. Veeam creates a hardened Linux repository that protects against malicious intent or deletion of data on the local backup repository.

In the meantime, Veeam backs up 10 TB across 50 VMware vSphere virtual machines to Covenco’s cloud. Sohal said Veeam may eventually back up the housing association’s 220 Exchange Online mailboxes to Covenco’s cloud as well. Veeam Backup for Microsoft Office 365 provides comprehensive data protection to ensure complete access and control of data.