Recovering from Data Robbery

When ransomware strikes, resilience must respond. Veeam is here to help.

Let’s face it, cybercrime is everywhere: SEO poisoning, malvertising, Quishing (i.e., QR code phishing), and the emergence of deepfake voice cloning and videos. Ransomware is still among the biggest threats to organizations of every size, and no organization is immune. Threat actors live for the thrill of targeting our critical infrastructure, healthcare systems, schools, and anything else they can shake down. Unfortunately, it’s no longer an issue of if you’ll get that ransom note, it’s when.

In this kind of environment, organizations of all sizes need to put their data resilience at the forefront of their ransomware protection strategy. This means coordinating teams ahead of time and coming up with a response plan, proactively monitoring for threats, training staff, regularly testing recovery plans, and picking a resilient data protection solution that best fits your business needs. Solutions should help minimize data loss, downtime, and compliance exposure while safeguarding revenue by ensuring business continuity even when disruptions happen.

With this in mind, it shouldn’t be a surprise that Ray Heffer, Veeam’s Field CISO and Security Strategist, is a certified ethical hacker. Heffer’s obsession with technology began in the analog era when he would dismantle VHS copy protection schemes, which fascinated him. But it was the Commodore 64 that truly ignited his passion, having discovered the underground world of the demo scene, where programmers pushed 8-bit hardware beyond its intended limits. Late nights dialing into bulletin boards connected him to a global community of fellow enthusiasts who would trade software and knowledge across phone lines. Influenced by his father, an amateur radio and electronics enthusiast, Ray’s natural talents were encouraged and it didn’t take him long to build a career as a cybersecurity expert.

“I was a very curious child, and for me it aligned perfectly with my own career trajectory from

infrastructure to security leadership,” Heffer said. “Seeing how things work and why is an important mindset in cybersecurity because if you understand how a thing works, you can find its vulnerabilities. I don’t just mean reading the manual, but writing it.”

Heffer combines strategic security leadership with practical and technical expertise to help organizations align their cybersecurity initiatives with their business objectives. As Field CISO, he works with Veeam’s most strategic customers and leverages his expertise in modern security frameworks alongside his deep knowledge of global privacy regulations, including GDPR and CCPA.

“What I love about Veeam is our clear vision of integrating data resilience with data protection,” he said. “Many others in this space still treat backup as purely an operational necessity, but Veeam recognized very early on that data resilience requires a cyber resilience mindset.”

That mindset doesn’t throw the baby out with the bathwater as new tech solutions arise. For years, cybersecurity has been focused on preventative controls such as endpoint detection and response firewalls, which Heffer believes are still very much needed.

“They should not go away,” he said, “but despite enterprises spending millions of dollars on these controls, they still get hit by ransomware. We need to start asking: Why?”

Ransomware groups are heading right to backup data repositories to delete them. As reported in the Veeam Ransomware Trends Report (2025), 89% of organizations had their backup repositories targeted by a threat actor. Immutable backups – data that can’t be altered, deleted, or overwritten foil those attempts, and they are one of Veeam’s key cyber resilience components.

“We don’t even assume a company’s IT admin hasn’t been compromised,” he said. “As far as we know, the IT admin that runs the backup software could have inadvertently installed malware on the machine, and a threat actor has control.”

That said, there’s no point in having a backup if you can’t restore it reliably and quickly. Heffer noted that recovery has to be comprehensively and regularly tested. This multi-layered strategy is integrated throughout the entire data life cycle, and a zero trust data resilience approach always assumes there’s a breach.

“The zero trust framework is to never trust, always verify, and we integrate that in everything we do,” Heffer explained.

Partners in Resilience and Recovery

Not so long ago, an intruder on the network could remain undetected for hundreds of days. This is a metric we call dwell time, and global averages show this dwell time is now down to weeks.

“Imagine someone breaking into your office, searching through all your things, and staying there for several months until you discover their presence. It sounds crazy, but that was what is happening in our environments,” Heffer said.

This is a double-edged sword, since as organizations are now able to detect threats a lot faster, threat actors have to move a lot faster too. One of the contributing factors to how swiftly these attacks are happening nowadays is the initial access broker (IAB) marketplace. This means that threat actors can now buy access credentials for hundreds, sometimes thousands of environments, each one a sitting duck.

For AWS users, Veeam’s Secure AWS Backup and Recovery provides scalable, comprehensive data protection that goes over and above the native capabilities of AWS. With Veeam’s leading policy- based protection, users can reliably recover from accidental deletion, ransomware, and other data loss scenarios. This ensures resilient protection that frees up valuable time and resources for businesses.

The increasing popularity of public cloud computing necessitates a data resilience solution that adapts to new workloads, protects data, and speeds up recovery no matter the location or hosting model. Veeam’s unified platform enhances and optimizes resilience across AWS, whether workloads are in the cloud, virtual, physical, SaaS, or Kubernetes environments.

With advanced recovery capabilities and proven immutability, Veeam safeguards against threats while optimizing efficiency and bolstering security throughout hybrid-cloud setups. Veeam solutions are readily available on AWS Marketplace or can be deployed on private infrastructure, and Veeam facilitates seamless application mobility between these environments.

“Our collaboration with AWS provides comprehensive access controls, encryption via AWS Key Management Service (KMS), backup and recovery across accounts and regions, and automated

report generation for regulatory compliance,” said AWS Global Alliance Leader Bhushan Taravade. “As a competency partner in the AWS ecosystem, we will continue to enhance our shared commitment to customer satisfaction, focusing on key factors to ensure that our customers’ data remains secure, highly available, and resilient through the combined capabilities of Veeam and AWS.”

In 2024, Veeam acquired Coveware, who are experts in cyber-extortion incident response. This move brought best-in-class ransomware recovery and first responder capabilities that would further strengthen Veeam’s radical resilience solutions.

Coveware by Veeam’s industry-leading software and services enable rapid forensic triage, extortion negotiation and remediation, cryptocurrency settlements, and decryption services so data affected from ransomware attacks can be recovered.

“They bring expertise and instant response from handling thousands of ransomware cases each year, across organizations of all sizes,” Heffer said. “Their team really does possess an extraordinary wealth of knowledge across ransomware variants.”

It’s an unfortunate reality that businesses often pay ransoms because they’re unsure about their ability to deal with such a terrifying crisis. While Veeam’s core focus remains on helping firms avoid ransom payments through recovery and data resilience, Heffer believes that the industry needs to recognize this reality gap.

“Our own research shows that organizations frequently pay the ransom even when backups exist because they’re just not confident that their own recovery is adequate during these crisis scenarios,” Heffer said. “Coveware by Veeam addresses this gap by providing forensic triage, decryption tools, and negotiating expertise.”

In conversations about ransomware, the universe of threat actors, and cyber security attacks, it’s easy to forget that the treasure cyber criminals crave belongs to all of us, and Heffer is here to remind us of this.

“Ultimately, who’s at the end of that chain? Who’s the victim here?” he asked. “It’s us as individuals. It’s your data. It’s my data. Anyone with malicious intent will use it. It’s our data that ends up being exposed in these ransomware attacks. That’s what matters to me. Data theft always boils down to one thing for me, and that’s privacy.”