One click, and the shared drive was gone

The firm called us at 6:40pm on a Tuesday in March. A staff member had opened an attachment that looked like a client invoice, and the shared drive was encrypted within forty minutes.

Their existing backup was a drive plugged into the same server, so it was encrypted too. What saved them was an offsite copy their previous provider had set up in 2019 and never checked. It worked, by luck rather than design. We restored overnight and spent the following month replacing luck with a tested process: monitored backups, an offsite copy that cannot be reached from the network, and a restore test every quarter that someone signs.