After a ransomware attack, can restored records still be licensed?

Can records restored after a ransomware attack still be licensed?

Often yes, if the restored records are complete enough to be useful and the company can describe the gaps honestly. What buyers care about is not that an attack happened, but what history survived, whether it is intact, and whether anything was exfiltrated and published.

For an MSP, this is a familiar client conversation. You know which backups restored cleanly and which did not. That knowledge is exactly what the owner needs when completing a data inventory.

What do buyers actually care about after an incident?

Three things, in this order.

A company that cannot answer these cleanly is not disqualified. It is simply not ready to be inventoried yet.

How exfiltration changes the picture

If attackers copied data and leaked it, two issues arise. First, exclusivity: a typical license is exclusive for AI training for an agreed term, and publicly leaked material is harder to treat as exclusive. Second, rights and privacy: leaked personal information may have triggered notification duties that the company's counsel is handling.

The practical rule is to separate the leaked set from everything else. Records that were never exposed, such as an untouched ERP or an offline archive, can be assessed on their own. This is general information, not legal, tax or financial advice. The company's counsel should confirm breach-notification and disclosure duties.

The restore audit: a five-step check an MSP can run

1. List every system in the incident scope and mark each as untouched, restored, rebuilt from scratch or lost.
2. For each restored system, record the restore point date and the earliest record date visible afterward.
3. Spot-check a sample of old items, such as a ticket from several years ago with its comments and attachments, to confirm history survived.
4. Note any systems replaced during recovery, and whether the old platform's data was migrated or only archived.
5. Write a one-page summary the owner can hand to SourceX, without exporting or describing any actual records.

Step five matters. The MSP supports the company's description of gaps; it never moves content to the partner or to SourceX on its own initiative. Exports happen only under the company's instruction after an executed agreement.

Illustrative scenario

Illustrative: a 120-person logistics company restores its dispatch system and file shares from backup after an incident, but its email history before the restore point is gone. Its finance platform and ticketing system were untouched. The owner records email as lost, dispatch and files as restored, finance and ticketing as intact. The inventory shows several systems with multi-year history and one honest gap. That is a stronger submission than one that glosses over the gap.

What this means for an MSP referral

A client recovering from an incident may assume its records are no longer usable. Address that carefully: the question is what survived, not whether the company was hit. Do not raise the topic while the incident response is still active. Wait until legal, insurance and forensics have settled.

Systems that run for years without a rebuild help; so do archived systems. If most records live in a single platform, read single-system companies. If the client has no internal IT, see companies without an IT department. Remote-first clients are covered in fully remote companies, and contested records in ownership disputes.

When to hold off

• Forensics or law enforcement still control the affected systems.
• The company cannot say whether data was exfiltrated.
• Backups were never tested and nobody knows what history is intact.
• The sponsor will not discuss the incident with a buyer-facing process.

How rewards work

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee. No reward is guaranteed. See the referral program for managed service providers for role context, and check your own client agreements for conflict-of-interest and disclosure duties.

Next step

Check the client with the company fit checker and the who qualifies baseline, then register as a partner to introduce them. For an example of the record-level detail a good inventory captures, see the quality inspection records introduction checklist.