The ransomware attack happened a month ago; it was noticed October 28. Why isn't the site back up yet?
Pretty high chance their files are all encrypted, and backup files are probably encrypted too if it’s taken this long. Either that or their backup recovery process was never properly tested and has failed catastrophically. My money is on their backups also being encrypted and perhaps having to take extreme measures to recover, if possible.
It's also a question of hygiene: restoring a system that can be trivially cracked again a few days later, would be stupid. So you have to first understand what failed, then restore only bits that you know are safe. This might not be trivial.
Well-reasoned article with some insights into the core conceptual questions.
That's not what we expect from El Reg!
Wipe all systems and restore from backups - what's the problem?
Yeah, it's not like they could just crack you again in the same way a day later...
oh wait
Obviously you would patch whatever vulnerabilities allowed them to hack you the first time....
That depends a lot on what you know about the hack. In the worst case, everything gets rebuilt from first principles and then you slowly pour back any data you think is safe into the new environment. That can take some time.
Sure, you need take time to investigate, sure.
But there's no excuse for any organization to be brought down or held ransom if they have good backups in place.