The Backups Were the First Thing Encrypted

In 2016, a manufacturer of about forty people (ten in the office and thirty on the floor) ran its entire business on one server. That server held the ERP that scheduled and costed every job, along with every file the office produced.

The server ran Small Business Server 2003, which had passed the end of extended support the year before. Remote users reached it over RDP, left open to the internet because that was the easiest way to make remote access work. The backups were USB drives plugged into the same server.

The ransomware came in through that open remote access and encrypted everything it could reach. Because the backup drives were attached to the machine being encrypted, they were just more disk, and they were among the first things lost.

• The ERP was encrypted, so jobs couldn't be scheduled or costed and the order history was gone
• Every office file was encrypted
• The USB backup drives were encrypted along with the server they were plugged into
• The operating system was so old that current recovery tools no longer expected to meet it

The company had an IT person, and this was the day that arrangement reached its limit. They weren't a Tech Dynamix client. They called us because the person responsible had run out of answers, and thirty people on a production floor were about to have nothing to build from.

Triage came first, and it confirmed the worst version of the facts: there was nothing to restore from. There was no offsite copy and no disconnected drive, so the choice was to rebuild the business from paper or to pay.

That decision belonged to the owner, and with the ERP holding every order and every job, the owner paid. The ransom was several thousand dollars in Bitcoin, paid to criminals for the return of the company's own data. We won't present that as a strategy. It's the position a business is in when its backups fail along with it, and the rest of this case study exists so that no one reading it has to make that call.

Paying didn't end it, which is the part people don't expect. The attackers' decrypter assumed a current Windows system, and on a 2003-era server it failed, because runtimes it depended on weren't there and the tool itself was buggy. Tech Dynamix spent the weekend debugging the criminals' software, supplying the components it silently required and working around its failures, so the ransom the owner had paid would produce the data it was paid for.

The rebuild ran alongside that work. By the end of the weekend the core systems were running and the floor could work. Getting nearly everything back took just over a week, file by file and system by system, on hardware that should have been retired years earlier. That's what disaster recovery looks like with no plan in place.

The company came through it, which wasn't the likely result in 2016 for a business with encrypted backups and a server past the end of support.

• Core systems running after one weekend
• Nearly everything recovered in just over a week

The ransom turned out to be the smallest part of the cost. The downtime and the rebuild each cost more.

The company then became a managed IT client, and the setup that made the incident possible was taken apart. The server was replaced and remote access was closed off from the open internet. Backups moved to a backup and business continuity system that runs automatically, keeps copies away from the machines it protects, and is tested instead of assumed.

The lesson is the one the USB drives taught. A backup attached to the server it protects fails at the moment it's needed, because whatever takes the server takes the backup too. Paying the ransom isn't the recovery plan people imagine either: the money buys a broken tool written by criminals, and if nobody on your side can make it work, the payment buys nothing.

For a manufacturer whose ERP runs every job, backups that are kept apart from the server and tested take the ransom question off the table. We cover how to check yours in The Backup You Have Is Not the Backup You Think You Have.