After arriving onsite in less than an hour our worst fears were confirmed, our client had been infected with Ransomware. In a short time, we were able to identify that the virus Cryptowall 2.0 had been used to encrypt all of their files and was asking that a ransom be paid within 72 hours or they would lose all of their files. At the time, there was no way to decrypt the infected files without paying the ransom.

We created multiple backups of their server in case we could eventually decrypt the files in the future then because we had protected their environment with an extensive backup plan we were able to restore their server back to 1 hour prior to the infection, locate and delete the email that contained the link that infected their system and have them back to normal business for the next day. The most memorable things about this were that there was very little loss of data, the phone call to us came at the end of the day and the business was back to normal before the next day which meant that none of their employees lost any time from work and we saved the business a lot of money just by ensuring that there was a proper backup schedule in place from the beginning.