Comment Re:Backups? (Score 1) 271
The *daily* backups were almost certainly the 10TB of backups that were found and destroyed by the attackers. Which makes sense: you want your most frequent backups to be fully 100% automated so they're as up to date as possible whenever a hard drive dies (which, for most organizations, happens considerably more often than this kind of successful malicious attack). So your continuous and daily backups go onto media that are online 24/7. So when something like this happens, you're going to have to go back to the last time a secondary backup was made, and that's less automated (among other things, someone has to physically swap the media in and out, and if we're talking about 10TB of data, that's probably going to have to happen multiple times, over the course of a couple of days, to complete the backup), so it generally happens less frequently. Since this was a munitions factory, we can charitably assume they would have known they were a potential target for this sort of thing, and so probably would have at least done a secondary backup weekly? Probably. Most organizations don't have their sysadmins practice restoring from secondary backups on anything resembling a regular basis, so they won't really know what they're doing and will run into all sorts of minor-but-annoying setbacks and delays. Software that's needed won't be installed, and there won't be a complete list of it anywhere, so they'll have to fool around by trial and error figuring out why blah-blah-blah won't run, oh, we forgot to install foolib on the design department's database server, have to do that, ok, now why does it still not run, oh, it also wants the foolib extensions for Postgres, install that, rinse, repeat. Some data that are stored in oddball locations (typically, configuration stuff) will have been missed, and will have to be recreated. And so on.
It's hard to predict exactly how long that stuff will take, but my first guess would be more than a week.
Granted, that's a far cry short of the timeframe if the factory had been, say, bombed into craterdom. But this may have been cheaper, and in any case it also gives Ukraine a significant amount of information about the factory's operation, which could be valuable in other ways.