Colonial Pipeline paid $5 million ransom to Darkside hackers within hours after attack last week. Once paid, the hackers provided a decrypting tool to restore the company's disabled network. Tool was very slow to work though. bloomberg.com/news/articles/…
Story says Colonial restored netwrk from backups not decrypted systems, because decryption tool was too slow. Note tho, expert I spoke to yesterday says they never restore from ransomed machines because untrustworthy; they always use backup when available zetter.substack.com/p/anatomy-of-o…
Some might ask why, if Colonial paid Friday, it took so long to get pipeline running. As noted in story👇 restoration from backups can take 1-2 months. Expert told me companies often don't have plan for restoring backups, and takes time to coordinate. zetter.substack.com/p/anatomy-of-o…
If Colonial had backups, why pay to decrypt ransomed machines? Because backups don't include all files - just essential ones to run the business. But companies still want/need access to files from ransomed worker desktop computers, which they will recover as needed over time.
Here's an explanation - from story I published yesterday - about why a company paid a $2 million ransom to Darkside last year, even though the company had backups. 
• • •
Missing some Tweet in this thread? You can try to
force a refresh
