UHSP says LockBit gained access in April 2023 through what investigators believed was a compromised employee account used from an unmanaged personal laptop over VPN. The attackers then moved through cached credentials, created backdoor accounts, obtained elevated access and encrypted systems at the hypervisor layer. Backblaze’s case study confirms the broad outline: the school’s internal systems and Active Directory were compromised, while its B2 backup tier remained available.
The university’s recovery demonstrates the value of off-domain storage, but it also shows why backup isolation must include identity, credentials, documentation, and recovery hardware. A storage bucket protected by Object Lock is not an operational recovery plan if its access keys, password vault, MFA device, or restore instructions are reachable only through the environment that has just gone dark.
Active Directory Was the Operational Failure Point
UHSP’s student-facing SaaS services apparently kept running, so students could continue attending classes and submitting work. The outage was most severe in the on-premises environment: Active Directory, building automation, security cameras, lighting controls, badge administration, and internal account management were disrupted.
The practical detail is important for Windows administrators. When Active Directory is unavailable, the incident does not stop at user logons. Domain-dependent backup consoles, service accounts, privileged access workflows, password-management integrations, hypervisor administration, endpoint tooling, and provisioning systems can all become unavailable at once.
UHSP said door schedules kept operating because the badge readers retained them locally, even though staff could not change the schedules. That is a modest but consequential example of graceful degradation: a building system continued its last known safe behavior when its management plane failed. The university could not create or remove accounts, reset passwords, or centrally manage physical-access schedules, but it avoided an immediate campus-wide door failure.
For organizations with Windows Server and Active Directory at the center of operations, the lesson is to map the systems that silently depend on domain authentication before an incident. A backup repository may be technically untouched and still be unavailable if it requires a domain account, an on-premises password manager, a domain-joined administration workstation, or an internal DNS and certificate chain to reach it.
CISA’s ransomware guidance makes the same distinction in more formal terms: backups should be offline or otherwise isolated, regularly tested, and paired with accessible recovery documentation. The agency also specifically recommends keeping backup keys separate from the systems that may be encrypted. UHSP’s experience turns that recommendation from a checklist item into a hard operational requirement.
The “Third Copy” Worked, but the Credential Design Did Not
UHSP had three backup tiers. Its primary and secondary backups were on campus, while a third copy was stored offsite in Backblaze B2. The tertiary environment was not tied to the university’s domain or normal user accounts, which prevented the Active Directory outage from automatically destroying the backup data.
That segregation appears to have made the difference. Backblaze says the B2 backup was encrypted and protected with Object Lock, its immutability mechanism intended to block deletion or alteration during a retention period. Lewis told Healthcare Innovation that the university was able to pull down and restore Active Directory from the cloud copy, initially using an esports gaming PC because suitable server hardware was unavailable.
But the recovery path still had a single point of failure: access credentials. UHSP’s normal password manager was unavailable because the primary environment was down. The backup credentials were reachable only because someone had saved them outside the institutional vault in a personal password manager — a policy violation that happened to preserve the only usable route into the cloud backup.
That is not a recommendation to scatter enterprise credentials across personal accounts. It is evidence that the university had not designed and rehearsed a sanctioned break-glass access process. A recovery architecture that depends on an undocumented exception will eventually fail at a less fortunate moment.
A stronger design would include dedicated emergency credentials that are not federated through the primary identity provider, stored through a controlled offline or separately governed process, and tested on a schedule. It also needs a plan for MFA: if the only registered authenticator is a company phone, company email account, or device managed through a compromised directory, the backup can be just as inaccessible as an encrypted local disk.
The relevant question for a recovery exercise is not, “Can we see the backup?” It is: “Can a responder who cannot log into Active Directory, Microsoft 365, the corporate password vault, the VPN, or the normal device-management platform authenticate to the backup service and restore a domain controller?”
LockBit’s Ransom Demand Was Not the Main Recovery Cost
Lewis said LockBit initially demanded about $1.25 million, then lowered the price to roughly $750,000 in exchange for not publishing stolen data. UHSP refused to pay. According to Lewis’s account, the gang eventually published a little more than 2 GB of material, and the university found only four Social Security numbers in the exposed files.
ControlD’s recent write-up of a Zach Lewis interview likewise reports the $1.25 million initial demand and the later reduction to $750,000. The precise volume of data LockBit possessed cannot be independently verified from public reporting, and ransomware operators routinely exaggerate exfiltration claims to increase pressure. The meaningful result is clearer: intact recovery capacity gave UHSP room to reject an extortion demand instead of treating payment as the fastest way to regain systems.
That does not mean recovery was cheap. Lewis estimated the incident cost at roughly $300,000 through recovery services, insurance deductibles, diverted staff hours, and legal expenses. The institution also had to negotiate, investigate, rebuild trust in its environment, and cope with operational outages for weeks.
The gap between a $750,000 demand and a $300,000 recovery bill should not be read as a clean financial win. It shows that ransomware resilience reduces leverage; it does not erase incident costs. Good backups may eliminate the need to buy a decryptor, but they do not replace forensics, legal review, notification analysis, insurance coordination, rebuilding, and the labor of validating that restored systems are clean.
Hypervisor Recovery Needs More Than Endpoint Coverage
The reported attack path also deserves attention. Lewis said the attackers reached the hypervisor after using a compromised account, VPN access from a personal device, and cached credentials to escalate privileges. Backblaze’s case study says attackers encrypted at the hypervisor level.
For virtualized Windows environments, that is a particularly damaging place to lose control. Encryption or destruction at the hypervisor can take down many guest servers simultaneously, including domain controllers, file servers, backup infrastructure, administrative jump hosts, and management systems. Endpoint tools installed in individual guest operating systems may not provide a meaningful warning if the disruptive action occurs below the guest layer.
CISA’s guidance has long emphasized separate administrator accounts, least privilege, stronger protection for domain controllers, and review of unrecognized accounts. UHSP’s post-incident description illustrates why those controls need to extend beyond Windows endpoints to VPN access, hypervisor administration, backup service accounts, and the paths that connect personal devices to corporate credentials.
Organizations allowing BYOD VPN access should specifically review whether unmanaged endpoints can use passwords alone to establish remote access, whether conditional access is enforced, and whether standard user credentials can reach management networks. A compromised employee account should not become a route to cached administrative credentials and then to the virtualization layer.
Quarterly Restore Tests Are the Part Worth Copying
After the incident, UHSP said it began testing restores quarterly from each backup location and documenting the process so another staff member could restore a server if the usual administrator was unavailable. That is more valuable than a generic instruction to “test backups,” because it defines the real unit of testing: the complete recovery path under degraded conditions.
A useful ransomware restore exercise should include these conditions:
- The test should assume Active Directory, the corporate password manager, VPN access, and standard administrative workstations are unavailable.
- The team should verify it can authenticate to the offsite backup using approved emergency access, not an individual’s remembered password or personal device.
- The test should restore a representative Windows server or domain controller into clean, isolated infrastructure and confirm that the recovered system is usable.
- The team should verify that required hardware, hypervisor capacity, licenses, networking details, certificates, and recovery documentation are available outside the affected environment.
- The exercise should record elapsed time, failed dependencies, decisions made, and the named person responsible for closing each gap.
UHSP reached full remediation around the first week of July, after an attack that it says began with initial access in early April and active disruption later that month. The dates underscore the central point: ransomware recovery is measured in weeks of reconstruction and validation, not the minutes needed to start a restore job.
The university’s backup survived LockBit. Its recovery nearly depended on luck. The difference between those two statements is the work every Windows and infrastructure team should do now: build an isolated copy, protect it with immutability, and prove that someone can actually retrieve it when the identity system, password vault, and normal server room are no longer available.
