Ransomware Attack Foiled: Bilthoven Biologicals’ Swift Recovery with Commvault

Dutch Vaccine Manufacturer Overcomes Ransomware Attack with Commvault

Bilthoven Biologicals, a leading Dutch vaccine manufacturer, resumes operations after a devastating ransomware attack with Commvault’s help.

Mitigating risk of ransomware attacks

Established by the Cyrus Poonawalla Group after the privatization of the Netherlands Vaccine Institute in 2012, Bilthoven Biologicals (BBio) develops and supplies polio vaccines to the World Health Organization, UNICEF, and many countries worldwide. With a team of motivated experts working around the clock, BBio delivers affordable, high-quality vaccines that help prevent life-threatening diseases.

To continue its mission of making vaccines for a better world, it’s critical for BBio to protect its data against ransomware attacks and ensure seamless manufacturing operations.

“Ransomware is not something that you can prepare for fully as you don’t know when it will strike. Bad actors only need to find one weak spot to attack your organization’s data,” said Paul Vries, IT Consultant, Bilthoven Biologicals. “Being the IT department, we always have to make sure that everything is secure. With Commvault, we can build a defense mechanism to prevent cyberattacks and enable rapid recovery.”

Restoring data with ease

BBio experienced its first major ransomware attack on September 21, 2022. It started with some calls from users who were not able to log in or access their files. After conducting some searches, Vries discovered a ransom note saying that their files were encrypted and demanding payment to get them decrypted.

“The ransomware spread through the domain field and the factory. Basically, everything connected to the Active Directory was compromised,” said Vries. “We had to move quickly to stop the spread as we weren’t sure of the exact scope of the impact.”

Vries immediately connected with BBio’s management and cybersecurity team, as well as KEMBIT, the company’s managed service provider, to analyze the situation and determine the next actions. Their first response was to disconnect the network and shut down the servers and virtual machines infected by the attack, while leaving unaffected machines on to minimize the impact on the vaccine production process.

Another important step was to inform employees what was happening, so they understood the criticality of the situation.

On the second day of the attack, Vries and the team was able to get the Active Directory and the Commvault environment back online. After rebuilding the Commvault Cloud Backup & Recovery, Vries said it was easy and straightforward to restore service.

“We love the simplicity of the Commvault dashboard. With just a few clicks, we can restore a virtual machine or backups after an attack which is vital in our line of work as a pharmaceutical company with very sensitive data,” said Vries. “Commvault gives us confidence that our data is safe, and our important services can be up and running quickly.”

As Commvault was so easy to use, the team could take turns restoring the company’s services throughout the night and until everything was restored. Thanks to the partnership between the IT team, KEMBIT, and Commvault, BBio was able to fully restore service across multiple offices and its factory in just nine days.

“If we didn’t have Commvault and the backups were not made before the attack, the situation could have been much worse,” said Vries.

Building a disaster recovery plan

Since the ransomware incident, BBio and the IT team learned some important lessons.

“We didn’t have a recovery plan in place before the attack,” said Vries. “We are now working with Commvault to build a disaster recovery plan so we know better what is important to get up and running first, and in what order.”

Some files were not encrypted during the attack because BBio moved the media agents outside the domain. With the switch to Microsoft 365, the company is also implementing Commvault Cloud Air Gap Protect with Commvault Cloud Backup & Recovery to further simplify backups for the hybrid environment and strengthen ransomware protection.

“With Commvault and Commvault Cloud Air Gap Protect, we can easily manage, protect, and recover data in the cloud and on-premises, even in the worst-case scenario,” said Vries.