3 September 2026LANTEK Computers
This is a composite, not a client. It is assembled from the shape these incidents generally take, at a fictional distribution business of forty people, to show where the time goes. No real business is described and no figures are quoted.
Monday, before anybody knows
The part everybody underestimates. The initial access did not happen this morning. Somebody has been in for a while, and the encryption is the last step rather than the first.
Typically the entry was a password that worked, and the time since has been spent looking around: finding the file shares, working out which server holds what, locating the backup, and quietly increasing rights. Understanding this changes two decisions later, so it is worth stating plainly. It means data was probably copied before anything was encrypted. And it means the backup was probably found before it was needed.
Tuesday, 07:40
The first person in cannot open the shared drive. She assumes the network. She telephones the colleague who usually knows and he cannot either.
By ten past eight there are eleven people in the office, none of whom can work, and somebody has found a text file on the desktop with instructions in it. The next twenty minutes is the most consequential of the whole week, and it is entirely about what people do instinctively.
What helps: unplugging network cables, leaving machines running, and one person telephoning the provider. What hurts: everybody rebooting their machine to see if that fixes it, and somebody switching the server off at the wall. Why that matters is in the first 24 hours, and the short version is that an abrupt power cut destroys evidence you will need and can leave files in a worse state.
Tuesday morning
Two things run in parallel, and only one of them is technical.
The technical work is establishing scope. Which machines, which shares, whether the accounting data is affected, whether mail is affected, and critically whether the backup is intact. The answer to that last one determines the whole week.
The non-technical work is that forty people cannot do their jobs, and somebody has to decide what happens to them. Who is sent home, who stays, what is said to customers who are telephoning about orders. In our experience this is what nobody has thought about in advance, and it is the thing that consumes the managing director’s day.
Somewhere in here the insurer is notified, if there is cover, and the attorney is telephoned, because personal information was reachable and that raises a notification question.
Tuesday afternoon: the backup answer
Everything turns on this.
If the backup was reachable from the same network with the same administrative credentials, it is frequently encrypted too, and the business is now choosing between rebuilding from whatever exists elsewhere and considering the demand. That is a genuinely bad position and it is decided by a configuration choice made months earlier.
If the backup was separated, either offline or in storage that could not be altered, it is intact. The business is now facing a long restore rather than a crisis. Which is the entire argument in how to test a backup, and specifically the question about whether normal network credentials can delete it.
The second discovery on Tuesday afternoon is usually the timing: how long the restore will take. Businesses expect hours and the answer is often days, governed by data volume and link speed. Nobody has measured it because nobody has tried.
Wednesday and Thursday: the restore, and the order
Restoring is not one task. It is a sequence, and the sequence matters more than the speed.
Identity first, because nothing else authenticates without it. Then the file shares. Then the line of business application, which turns out to need a licence key nobody has, held by a supplier who takes a day to respond. Then the accounting data, which needs the version it was created in.
Meanwhile every workstation has to be rebuilt or verified before it is allowed back on the network, because putting a machine back that is still compromised restarts the whole thing. With forty machines, that is the bulk of the labour and it is not glamorous.
Thursday is when the plateau arrives: about seventy per cent of people can work, the remaining thirty per cent are blocked on the one thing that is awkward, and everybody assumes it is nearly over. It is not, and managing that expectation is a real task.
Friday: partially working, and the harder question
Most people are back. The gaps are now specific rather than general: a system nobody prioritised, a set of records from between the last backup and the incident that has to be re-entered by hand, and reconciling what was and was not captured.
And the question that outlasts the technical recovery: was personal information taken. Not encrypted. Taken. Because if it was, there is a notification duty regardless of how well the restore went, and that assessment depends on logs and records from before the incident. A business with little logging cannot answer it and has to reason from what an attacker could have reached rather than what they did. When you have to notify covers the test.
The following weeks
Re-entering the gap. Explaining to clients why an order was late, which is where the reputational cost actually lands, in dozens of small conversations rather than one public event. Rebuilding trust with staff, who watched the business stop. And the security work that should have happened before, now done under a deadline and with a budget that was suddenly available.
What made the difference, and what did not
Consistently, four things determine whether this is a bad week or a business-threatening one.
Whether the backup could be reached with normal credentials. The single biggest factor, decided long in advance.
Whether anybody had timed a restore. Not whether backups ran. Whether the duration was known, so decisions on Tuesday were made against a real number.
Whether multi-factor authentication was on. This is the control that most often prevents the whole thing, because the entry was a working password. Why it is not optional.
Whether one person owned the decisions. Not the technical work. The decisions: who goes home, what customers are told, whether to notify, whether to involve the insurer.
What made surprisingly little difference: the specific antivirus product, and how quickly the encryption itself was detected. By the time files are encrypting, the outcome is largely already set by choices made months earlier. Which is the argument for noticing the days of quiet activity beforehand, since that is the window where intervention is cheap.
The three things worth doing this month
Establish whether your backup can be deleted using credentials from your normal network. Time an actual restore and write the number down. Turn on multi-factor authentication everywhere, with no exemptions for senior staff.
Those three change the week described above more than any purchase would.
Other composites of how incidents unfold are in See it in action. If you would like to know whether credentials for your business are already circulating, the free dark web scan answers that in thirty minutes.