A potential ransomware attack has been detected.
Which two observations resulted in this conclusion?
Ransomware encryption rapidly changes many data blocks, causing Snapshot copies to grow significantly. Encrypted data also has low redundancy and is poorly compressible, so deduplication and compression storage efficiencies decrease. NetApp documents an exponential Snapshot-size increase and storage-efficiency decrease during ransomware encryption.
Community Discussion