A 3-site construction company survives a ransomware scare

// the problem

A convincing email, a bad afternoon

The company — around 45 staff across a head office and two active job sites — had been a managed client for about a year. The email that got through was good: it referenced a real supplier and arrived during invoice week. The estimator opened the attachment, and ransomware began encrypting the files their account could reach.

Why it didn't become a catastrophe

Two boring decisions made earlier did most of the work. Endpoint protection killed the process and isolated the machine from the network within minutes, raising the alert that started our response. And because the environment was segmented — site networks separated, file permissions scoped to role — the blast radius was one workstation and one department's share, not the company.

// the approach

Contain, verify, restore, prove

We treated it as a full incident regardless of how contained it looked. Friday evening: the workstation was pulled for reimaging, the estimator's credentials were reset, and every endpoint was swept for the same payload. Saturday: the encrypted share was restored from the previous night's backup — the same backups whose restores we test quarterly, which is why nobody had to hope. Sunday: we verified file integrity with the department lead and confirmed the initial email's path, then closed the gap in the mail filter rule that had let it through.

Monday 8am, all three sites worked normally. Total data loss: a few hours of one estimator's Friday work. The incident report went to the owners in plain English the same week, and to their insurer without follow-up questions.

// the outcome

What actually changed

• No ransom was paid, and no client or bid data left the company.
• One workstation was reimaged; roughly six working hours were lost in one department.
• The phishing simulation program got a new template based on the real email — click rate on that pattern has since dropped measurably.
• The owners now describe security spending as insurance that paid out.

The honest caveat: this went well because the groundwork existed. The same email landing at the same firm two years earlier — flat network, untested backups — would have been a very different story, and a much more expensive case study.