How the HAHN Automation Group is making its backup ransomware-proof with Silent Bricks from FAST LTA

How the HAHN Automation Group ensures its backup system is resilient

The company, which employs around 1,300 people, currently has 7.6 petabytes of installed storage. Globally, huge volumes of data are generated for the design, documentation and maintenance of operational systems. The systems have long service lives at the customer’s site and require a high degree of personalised support, which in turn involves data collection, access and analysis, in some cases stretching back more than 20 years. The challenge for IT therefore lies not only in the volume of data, but also in the complexity and the highly demanding nature of how users access data across different locations.

For several years now, the HAHN Automation Group’s goal has been to set up large production storage environments whilst minimising costs. The issue of backup, particularly regarding authentication and retention periods, has been a priority for some time, not just since a ransomware incident. HAHN has been using a custom implementation of Veeam Backup & Recovery for years, with data collected decentrally but consolidated into three large centralised backup disk storage systems. Backup access rights were also controlled via AD, which was common practice in Veeam at the time but had proved to be a vulnerability. This prompted the company to make significant improvements. In conjunction with Veeam, FAST LTA’s Silent Bricks are used for the rapid recovery of critical systems.

Following the ransomware attack, in-house forensic experts helped to identify which data had been affected, though this took several weeks. It also became clear that backups alone do not provide protection against a ransomware attack, due to the speed involved and the potential need to rescan certain areas with antivirus software during the restore process. “Backup is a great thing for production issues, patches and maintenance, but not necessarily for ransomware,” explains Frank Benke, Head of IT at the HAHN Automation Group.

Based on risk management considerations, the IT team launched an initiative to clarify key questions:

• Where is backup/restore essential?
• How can we ensure it is carried out at maximum speed and quality?
• In the event of a major cyberattack, how can we ensure the company is operational again within a week?

The approach favoured by the IT team was to divide the system into a “red zone” and a “grey zone”. In the event of a massive attack, production would be “scorched earth”, as Benke puts it, and thus in the red zone. The grey zone contains systems that are only activated in an emergency to clean up data.

A corruption-proof backup medium was required

The solution lay in a storage system with high data transfer rates and the ability to prioritise restore jobs. This would make it possible to quickly restore the inventory and job control from the backup. This would be followed, at the touch of a button, by the automated rollout of all operating systems, including hypervisors, onto clean installation media. The IT team realised that a corruption-proof backup medium was required for all critical data sets that form part of the ‘family silver’. HAHN therefore needed a reliable secure storage solution for rapid recovery.

‘Our key requirements were performance, immutability and air-gapped storage, which led us straight to FAST LTA. Within our storage environment, FAST LTA’s Silent Bricks are a specialised solution for precisely these requirements, integrated into our overall backup strategy. We no longer have to wait for forensics to approve the backup time, but can get the core systems up and running within a few days,” explains Benke.

Solution not imposed, but developed jointly

“We put a lot of thought into the architecture. Our aim is to do as much as possible ourselves and to understand in detail what we are running. We had been aware of the options offered by FAST LTA for years. When the use case became tangible, we approached FAST LTA, and the solution configured for us fitted well within our budget. The solution wasn’t imposed by FAST LTA, but developed together with our team, so that it fits our concept and runs smoothly. We also put FAST LTA through its paces afterwards, and everything proved to be very reassuring,” confirms Benke.

FAST LTA was implemented in January 2025, and the commissioning went completely smoothly. “Subsequently, the FAST LTA support team informed us that there were new firmware updates; we installed these together, and it worked perfectly. The system is running stably, even after a power cut at the weekend, when we shut it down completely and restarted it for the first time. The FAST LTA Silent Bricks work very well with Veeam,” says Benke.

Most recently, the IT team tested the integration of FAST LTA with the new version of Veeam. They also tested whether the FAST LTA restore works directly on Proxmox, as well as the restoration of FAST LTA on VMware, all of which worked very well.

Fast Clone Support significantly reduces the backup window

The HAHN Automation Group uses Fast Clone Support from FAST LTA with Veeam Backup & Recovery, which significantly reduces the backup window, as synthetic full backups are typically created on a weekly basis. To avoid duplicate data as far as possible, the Silent Bricks’ file system can reference and link data blocks after they have been written. A synthetic full backup created in this way then consists almost entirely of references to the data blocks already present on the storage system. Veeam refers to the process of creating such a ‘link collection’ as Fast Clone. This is significantly faster and requires considerably less storage space than repeatedly writing a ‘real’ full backup.

Augmented Reality, Digital Twins and AI: Optimally equipped for current and future requirements

Data usage at HAHN also extends to Augmented Reality and Digital Twins, i.e. the simulation of the complete design and operation of systems and the re-enactment of operational scenarios using real data. This generates relatively large volumes of data, not only process data but also 3D-enriched simulation data. The company sees potential in this approach to substantially change working methods in mechanical engineering.

The HAHN Automation Group also considers itself optimally equipped for future backup requirements. “AI is already a topic, but data volumes have not yet changed substantially. AI does not necessarily mean that new data is generated; rather, it is about networking existing systems for smarter data usage, such as data from a vector database with metadata. Future AI-related tasks will focus on how data volumes develop, how much retention time is required, and how the current backup system performs under increased AI usage scenarios.”

FAST LTA provides the HAHN Automation Group with a high degree of security in potential crisis scenarios

Ransomware extortionists rely on companies paying the ransom in a situation of uncertainty. Whilst companies’ willingness to pay is declining, ransom demands are rising, which can quickly become a matter of survival.

“We are proud that we did not pay any ransom during the ransomware attack at the time. With FAST LTA, we are now much better positioned. In the event of a breach, we can now rely on the fact that certain validation steps are not required. This saves time, which is notoriously scarce in crisis situations. A backup architecture that focuses on everything that matters, delivers the necessary performance, offers immutability and enables air-gapping gives us a great deal of security in such scenarios.”