Scenario 01 Illustrative
Ransomware Halts a Manufacturer
An illustrative ransomware attack on a 250-person manufacturer: how we'd contain it, restore production and help leadership make the hard calls.
Illustrative scenario, not a client engagement. This is a hypothetical example based on common attack patterns. It shows how we'd approach the problem, and doesn't describe a real client, incident or result.
- Sector
- Manufacturing
- Scenario
- Ransomware
- Written for
- Leadership and IT teams
The situation
At 6 a.m. on a Monday, the night supervisor at a 250-person manufacturer calls the operations manager: nobody can open the production schedule. File servers, the ERP system and the shipping system are all encrypted, and every screen shows a ransom note demanding payment in cryptocurrency.
The machines on the plant floor still work, but without schedules, orders or shipping labels, production stops. The attackers claim they've also copied engineering drawings and employee records, and threaten to publish them in seven days.
What's at stake
The risks
- Every day of downtime means missed shipments, idle staff and possible penalties under customer contracts.
- Stolen employee records may create a legal duty to report the breach to Alberta's privacy commissioner and notify the people affected.
- Engineering drawings and customer data could be published or sold.
- Leadership faces pressure to pay a ransom without knowing whether the attackers will keep their word.
Our approach
How we'd help
- Contain. In the first hours, isolate affected systems, disable compromised accounts and cut off the attackers' access, while preserving the evidence needed to understand what happened.
- Investigate. Establish how the attackers got in, what they touched and whether data really left the network, so decisions about notification and negotiation rest on facts rather than the attackers' claims.
- Recover. Restore from clean, verified backups in priority order (identity systems first, then scheduling, ERP and shipping), rebuilding rather than trusting compromised machines.
- Harden. Close the entry point, enforce multi-factor authentication, separate plant systems from office IT, and put immutable backups and 24/7 monitoring in place.
Decisions for leadership
- Bring in legal counsel and notify your cyber insurer immediately. Most policies require prompt notice, and some require approved response firms.
- Decide whether to pay. It's a business, legal and ethical decision: payment doesn't guarantee working decryption or deletion of stolen data, and payments to sanctioned groups may be prohibited.
- Agree what to tell staff, customers and suppliers, when, and who speaks for the company.
- Decide, with legal advice, whether the breach creates a real risk of significant harm that must be reported.
Technical notes
- Common entry points include VPN or remote desktop access without MFA, phished credentials and unpatched internet-facing devices.
- Look for shadow copy deletion, tampering with backup consoles, privileged logins from unusual hosts and data-transfer tools such as rclone.
- Assume identity is compromised: rotate privileged credentials, reset the krbtgt account twice and rebuild domain controllers if needed.
- Restore into an isolated environment and scan restored systems for persistence before reconnecting them.
- Segment operational technology from corporate IT so an office compromise can't reach the plant floor.
The takeaway
The organizations that recover fastest decided in advance who does what, and kept backups the attackers couldn't reach.
Related reading
Next step
Could this happen to you?
Tell us what you're protecting. We'll help you find the gaps before an attacker does, and plan how you'd respond if one gets in.
Book a consultationPrefer to talk?