Restoring production in 14 hours after a ransomware incident
A mid-sized manufacturer lost access to its ERP and file infrastructure overnight. We contained the incident, restored from isolated backups, and rebuilt identity controls to close the entry point.
14 hrs
Time to production restore
$0
Ransom paid
< 1 hr
Data loss window
The challenge
Attackers gained access through a compromised remote-desktop account with no multi-factor authentication, encrypted the primary file server and the on-premise ERP database, and deleted the accessible backup catalogue. Production scheduling stopped entirely.
What we did
We isolated affected segments within the first hour, confirmed the offline backup set was intact, and rebuilt the ERP host from clean media. Identity was rebuilt with enforced multi-factor authentication and conditional access, and remote-desktop exposure was replaced with a brokered gateway.
The outcome
Production scheduling resumed within 14 hours of engagement. No ransom was paid. The subsequent insurance review accepted the rebuilt control set without a premium increase.
Let's talk about what you are running
A short conversation, an honest assessment of your current setup, and a clear proposal. No obligation and no pressure.