The firm was a professional services practice with twenty staff and a single server room in a converted back office. The infection came in through a remote-access tool that had been left open for an out-of-hours contractor, and by the Monday morning every shared drive was encrypted and the accounting system would not open. Nobody had touched a dodgy link; the door had simply been left ajar for months.

The ransom demand was the part everyone fixates on, and it was the least of it. They did not pay, because a backup from the Friday night had survived on a drive that happened to be unplugged. What actually cost money was the standing still: three days with no billing, no client files and no email while the systems were rebuilt from scratch, and a specialist bill for the forensic work needed to be sure the intruder was really gone.

The fortnight nobody talks about came next. Restoring the data was quick; trusting it was not. Every password had to be changed, every device rechecked, and every member of staff walked through what had happened so they would not quietly reuse an old login. Two clients heard about it secondhand and had to be reassured in person. The work of proving you are clean takes far longer than the work of getting back online.

What saved them was ordinary and unglamorous. One backup that was genuinely offline, so it could not be encrypted with everything else. One person who knew where it was. And a willingness to shut everything down on the Monday rather than press on and hope. The mistake that let it in was equally ordinary - a convenient shortcut that nobody revisited once the contractor had finished.

We tell this story because the honest version is more useful than the frightening one. It was not a sophisticated attack and it did not need to be. It needed one forgotten door and one working backup to decide the outcome, and the difference between those two things was a couple of hours of dull maintenance that never got booked in.