The Gentlemen Ransomware Recovery

This case study documents the recovery of seven production SQL Server databases of an ERP system after an attack by The Gentlemen ransomware. The databases were recovered directly from the encrypted data files, without the attackers’ key.

Client & Data Information

• Client Name: Confidential (an IT services company)
• Data Type: Microsoft SQL Server, ERP production databases (MDF data files)
• Data Capacity: seven databases of about 1.4 TB each, 9.8 TB in total
• Ransomware: The Gentlemen
• Ransomware Extension: .9jeael
• Recovery Time: 6 hours

Incident Summary

The company’s SQL Server environment was hit by The Gentlemen ransomware. All seven production databases behind its ERP system were encrypted and renamed with the .9jeael extension, and SQL Server could no longer open any of them. The ERP system, and the business that depends on it, stopped.

How the Recovery Was Done

• Work on the encrypted files themselves: each database was recovered from its encrypted MDF file. Nothing was written to the original files.
• One database at a time: at 1.4 TB per file, every database was recovered and repaired separately until it was consistent and usable again.
• No ransom, no decryptor: the work did not depend on a key from the attackers.

Result

All seven databases were fully recovered and repaired to a consistent, working state, and returned to the client. The recovery took 6 hours.

How much can be recovered after a ransomware attack differs from case to case: it depends on how much of each file the ransomware really encrypted. We measure that on your files first and tell you what is realistic before any chargeable work starts.

Hit by The Gentlemen or Another Ransomware?

Do not restart, reinstall or restore over the affected servers. Keep the ransom note and a few encrypted files, and contact us for a free assessment.

• Ransomware data recovery
• Database recovery: SQL Server, Oracle, MySQL
• The Gentlemen ransomware: what is recoverable
• Contact AS Data Recovery