
Manufacturing · 90 seats
Ransomware recovery in 26 hours
The problem
A shop-floor workstation opened a malicious invoice attachment. Encryption spread to two file servers and the backup appliance was unmonitored and 40 days stale.
What we did
- Isolated the network and imaged affected hosts for forensics
- Rebuilt domain controllers from clean media
- Restored production data from an untouched offsite copy
- Deployed EDR, MFA and immutable backups across all sites
26 hrs
To production restored
0
Ransom paid
40 → 1 day
Backup recovery point

