Data Loss? How to Respond Correctly

If you notice data loss, the first few minutes are critical to the success of recovery. Act thoughtfully.

• Take a deep breath: Panic leads to mistakes. Follow this plan.

• Inform the person in charge of your IT: Contact your internal or external IT partner immediately.

• Isolate devices: Disconnect affected computers from the network (turn off Wi-Fi or unplug the LAN cable). Do not shut them down if ransomware is suspected (encryption keys may be lost from RAM).

• No solo attempts: Do not try to recover data using free tools from the internet. These often overwrite irrecoverable fragments.

• Document everything: Briefly note what happened, which error messages appeared, and when the issue was discovered.

Before starting the recovery, the situation must be clear. Only then can the appropriate recovery strategy be selected.

• Identify affected data: Are they local files, server data, or cloud services (e.g., M365)?

• Investigate the cause:

  • Technical: Hardware failure?
  • Human: Accidental or intentional deletion?
  • Cyberattack: Encryption by ransomware? (If yes, immediately involve specialized experts!)

• Set priorities: Which systems are critical for operations (e.g., ERP, mail server)?
• Check backup status: What is the last clean recovery point? With a MOUNT10 backup solution, you have the assurance that your backups are performed regularly and successfully. In case of irregularities, our support team will contact you directly.

The analysis is complete, and now comes the restoration of your data. With MOUNT10 as your partner, you can rely on the highest security standards and Swiss reliability.

• Define a strategy: Based on your analysis, determine the ideal recovery point (Point-in-Time). Thanks to MOUNT10’s versioning, you can also access data states from before an unnoticed infection.
• Prioritized recovery: During the analysis, you have already identified which systems are essential for operations. Restore these systems first to ensure your business can resume operations as quickly as possible.
• Integrity before release: Check the restored data in an isolated environment for completeness and functionality before putting it back into production.
• Use support: You are not alone. If uncertainties arise during the recovery process, MOUNT10 support is available with technical expertise.
• Security check: Ensure that the original cause (e.g., a security vulnerability) has been resolved so that the freshly restored data is not immediately at risk again.

A technical incident is also a communication challenge. Clear information prevents rumors and maintain the trust of your business partners and customers.

• Inform internally first: Provide your employees with guidance. Who is affected? What is being worked on? What should each person do (or avoid doing) right now?
• Facts before speed: Inform customers or partners only once verified facts are available. Avoid speculating about the cause.
• Show transparency: Communicate openly that recovery from backup is in progress. This signals capability and preparedness.
• Use tools: Utilize our Recovery Text Assistant (below) to quickly generate factual templates for emails or statements.

After recovery comes prevention. Use the incident to strengthen your defenses for the future.

• Fix the cause: Ensure that the security vulnerability or hardware failure that led to the outage has been permanently resolved.
• Refine your backup strategy: Check whether your backup intervals still align with your business processes. Use MOUNT10’s immutable backups to protect against ransomware.
• Awareness training: Educate your team. Often a simple click on a link is the trigger – human errors can be minimized through training.

A completed incident is a valuable learning opportunity. Document the process to be even faster next time.

• Debriefing: Discuss as a team: What went well? Where were there delays? Was the role distribution clear?

• Documentation: Record the incident in the IT emergency manual.

  Documented experience helps to manage future incidents more efficiently.

• Update the emergency plan: Adjust checklists and contact lists based on the new insights.

• Plan recovery tests: Make recovery a routine. Schedule the next test run for the upcoming quarter.

• In case of suspected or confirmed data theft, the relevant authorities or the police must be informed.

• In Switzerland, reporting obligations apply under data protection law (e.g., reporting to the FDPIC [EDÖB] in the event of a data breach).

  More information: https://www.edoeb.admin.ch/en/databreach-4

In the case of complex security incidents, involving an external incident response and forensics company can be beneficial.

External specialists assist with:

• Root cause analysis and evidence preservation

• Assessment of the damage

• Legally compliant procedures

• Recovery and hardening of systems