SiteOne Landscape Supply counts on Cohesity for ransomware recovery

The Challenge

SiteOne has grown primarily through mergers and acquisitions to more than 600 locations. Following an inventory conducted while converting its production data center into a disaster recovery site and standing up a new production environment in another location, SiteOne IT realized the amount of additional support to meet field team requirements with legacy products was growing exponentially—work that required tedious, manual intervention and contributed to rising costs. IT staff managed both virtual machine (VM) infrastructure as well as Veeam and Data Domain infrastructure, which required continual investments in new licenses and forklift array upgrades to add capacity. One employee spent most of his day, every day, reviewing backup issues and troubleshooting.

“There were many different levers to scale what we had—adding resources, VMs, capacity—but it was all overly complicated and someone would have to constantly tweak it,” said David Bannister, vice president of Technology Services for SiteOne. “If we weren’t going to grow, our current solution would work for backups, but not restores. We knew there were better, more modern solutions on the market for consolidating, simplifying, and scaling data management.”

The Solution

After a referral to Cohesity by the company’s infrastructure partner, Cumberland Group, SiteOne completed a Proof of Concept, then moved forward to production use. The company found Cohesity’s converged data security and management platform to help it speed backups and restores for VMs, and soon after, its Windows files shares. Because Cohesity is cloud native, SiteOne could also quickly enable local backups to be archived to Amazon S3 for long-term storage and retrieval, when needed. Moreover, Cohesity added a layer of security, in that it would help the company stay operational in the event of a cyberattack.

“Cohesity backup policies were very easy to set and basically ran on autopilot,” Bannister said. “Management was simpler, through one pane of glass, as opposed to manually trying to schedule hundreds of jobs. And we had peace of mind, knowing everything that’s really critical was getting backed up within the right window.”

The new solution was working well—with Cohesity backing up VMs and IT migrating corporate file shares to Cohesity file and object services—when on July 14, 2020, SiteOne detected a ransomware attack on its IT systems. Promptly upon detection of the attack, SiteOne launched an investigation and notified law enforcement, and legal counsel and other incident response professionals were engaged. SiteOne recovered all of its critical operational data with the help of Cohesity, and the incident did not have a significant impact on SiteOne’s business operations or ability to service its customers.

From an operational perspective, SiteOne was able to be back in business 24 hours later, although the triage and subsequent investigation would be round the clock for the next month. SiteOne did not incur net expenses from information security breach penalties or settlements over the last three years.

The company implemented containment and remediation measures that included using the immutable backup snapshot, taken the night before by Cohesity, to quickly rollback and rapidly recover critical operational data—at scale. Bannister adds, “While some of the data restored by Cohesity was not necessarily labeled as ‘mission-critical’, every piece of data is important to someone, and directly impacts our business. With Cohesity, we were able to be back up and running in 24 hours. Once the production environment was back online, our internal teams were then able to restore the rest of our data without having to decrypt anything.”

“It’s not a matter of if a business will get hit with ransomware, it’s when, and organizations need to be thinking realistically not just about how to prevent attacks, but about how quickly they can respond when there’s a need to restore tens or hundreds of VMs or files at once. With Cohesity, it was fast—a couple clicks and minutes—and everything was back,” explains Bannister.

The Results

With Cohesity, SiteOne has reduced data management complexity as well as capacity and licensing costs, but also enhanced their cyber resilience. Because the solution is simpler to use, anyone on the IT staff can quickly perform backups and restores.

Cohesity was also instrumental in helping SiteOne restore VMs and other unstructured data within minutes after a ransomware attack. In contrast, data that was still protected by the company’s legacy solution took two weeks to fully get back into place.

“Cohesity snapshot views proved instrumental and provided deep insight to our forensic teams, as well as enabled SiteOne to determine what steps were needed to meet regulatory requirements. Having the ability with Cohesity to paint a complete picture of the ransomware attack helped us move forward and identify next steps not only for IT and Security teams, but also for our Legal and Communications departments. Without our Cohesity views, we would not have been as equipped to rapidly investigate and perform the needed forensic activities,” said Bannister.