---
title: Telemadrid restores 100% of critical systems after massive ransomware attack
url: https://www.dataloco.com/en/telemadrid-restores-100-of-critical-systems-after-massive-ransomware-attack
published: 2026-09-27T21:20:29+00:00
language: en
section: Security
source: https://www.computing.es/noticias/telemadrid-restablece-el-100-de-sus-sistemas-criticos-tras-un-ciberataque-masivo-de-ransomware/
organizations: Telemadrid, SoftwareOne, Dell PowerProtect, Microsoft Azure
publisher: Dataloco
---

# Telemadrid restores 100% of critical systems after massive ransomware attack

Television public organization faced a ransomware attack that encrypted its production systems and threatened its live broadcasting continuity. The cyber offensive aimed at economic extortion by blocking operational infrastructure, putting at risk the informational heritage of the organization and potentially leading to million-dollar losses.

To manage the incident, the public entity activated a crisis committee and began recovering operations with the help of its technology provider, SoftwareOne. The company's intervention was channeled through its Managed Backup Service 24/7, taking direct control of the data protection environment to counter the extortion attempt.

The recovery strategy was based on an unalterable local architecture, structured on Dell PowerProtect (DD6400) systems, which prevented local backup copies from being altered by the malware. Due to the compromise of external networks and communications, the technical team proceeded to set up servers from scratch in a sandbox testing environment, avoiding suspicious data lines.

The technical process involved a direct dump of information from protected storage devices to the production network, with prior verification of each virtual machine to ensure a threat-free environment. Thanks to this procedure, Telemadrid regained access to the central console and restored live broadcasts in less than 48 hours, without making any ransom payment.

The protection of the historical archive of the Madrid autonomous television responds to a cloud tiering scheme implemented on Microsoft Azure. This external digital vault functions as an automated replica of the chain's historical data, replacing traditional physical tape libraries and preventing the definitive loss of information in the event of potential failures at the main data center.

Due to the inability to operate with digital continuity systems, Telemadrid was temporarily forced to interrupt its regular live programming and resort to delayed broadcasts.

## This story in other languages

- [Português (Brasil)](https://www.dataloco.com/pt-br/telemadrid-restabelece-100-de-seus-sistemas-criticos-apos-ciberataque-massivo-de-ransomware)