A small U.S. construction firm shut down within months after ransomware, software that encrypts files to block access, hit its main server. The attack encrypted operating data and the only backup at the same time.
The firm lost payroll and billing records and could not continue operating. The firm's new chief financial officer had asked Intrust IT for security help. The owner rejected the plan as too expensive. He said the firm was too small to attract hackers.
Table of Contents
- Why did the firm reject security help?
- How did one server failure close the business?
- How did a second firm avoid disaster?
- What separates collapse from near-miss?
Why did the firm reject security help?
The new CFO wanted outside support from Intrust IT. The owner vetoed the proposal over cost. He said a relative's acquaintance handling IT was enough.
The Register gives this account in the Register's report on the rejected security proposal. Hatter told the story without naming the victim firm. He uses it to show a recurring small-business pattern.
How did one server failure close the business?
About three weeks after the rejection, ransomware encrypted the firm's old, unpatched Windows server. That server held all critical operating data. The firm had run for years before that day. The only backup sat on an external drive plugged into that same server. The ransomware encrypted the backup during the same attack.
No clean copy remained for recovery. Without payroll or receivables records, the firm could not pay employees. It could not tell which clients owed money. SC Media describes that loss in SC Media's brief on the firm's collapse. The business closed within months.
How did a second firm avoid disaster?
SC Media reports attackers hijacked an executive email account at a landscaping-construction firm. They sent legitimate-looking requests for proposals. Those messages directed recipients to a fake Microsoft 365 login page.
The phishing page used a man-in-the-middle relay, a trick that forwards the victim's code to log in as them. Intrust IT's TarBot tool spotted the odd Microsoft 365 login. It revoked access within minutes and prevented major damage. The Artificial Unintelligence summary of Hatter's account details that response in the summary of the TarBot detection.
What separates collapse from near-miss?
SC Media points to three controls that separated collapse from near-miss. Offline backups kept apart from production servers preserve recovery. Prompt patching closes old flaws.
Phishing-resistant multifactor authentication plus login-anomaly monitoring blocks stolen logins. Pick one machine to fix first. Disconnect one backup today and test a restore from it.
- Keep one backup offline and off site, disconnected from the main server.
- Patch the Windows server promptly and avoid one machine holding everything.
- Require phishing-resistant multifactor authentication and flag odd logins.
You Might Also Like
- Qilin Ransomware Leader Arrested in Germany After Japan Detention
- Royal Ransomware Update 2026: Disclosure, Response, and Open Questions
- Ransomware Negotiation Response Checklist: Passwords, Accounts, and Credit