How immutable backups and a solid disaster recovery plan saved a Pinellas Park manufacturer from paying the ransom.
Based on a real EasyWayIT client engagement; client details anonymized.
It was a Tuesday morning at 6:47 AM when the first employee arrived at this Pinellas Park precision manufacturing facility. Instead of the usual Windows login screen, every workstation displayed the same chilling message: "Your files have been encrypted by LockBit 3.0."
The attackers had struck over the long weekend, exploiting a vulnerability in an unpatched VPN appliance. By the time the infection was discovered, all three production servers were encrypted, along with 28 workstations and the company's file server containing:
The ransom demand: a Bitcoin payment within 72 hours, or the price would double. The threat actors also claimed to have exfiltrated sensitive customer data and threatened to publish it on the dark web.
With production halted and customers waiting, the company faced a devastating choice: pay criminals with no guarantee of recovery, or lose everything.
Fortunately, this company had engaged EasyWayIT eight months earlier for managed IT services. As part of our standard security stack, we had implemented:
The moment we received the call, our incident response team mobilized:
The business was back in production the same day, without paying the ransom.
Following the recovery, we implemented additional protections:
Restored from backups and operating again within the same business day
Not a dollar to criminals. Full recovery from backups.
Restored from immutable backups, with only a short window of work recreated.
Ransom avoided and extended lost-production downtime prevented
For the manufacturer, the ransom screen meant fifteen years of work, customer commitments, and everything they had built suddenly appeared to be at risk. Rather than facing that loss, the team was back in production the same day, and the money that would have gone to the attackers stayed in the business instead.
Immutable backups are essential. Regular backups aren't enough - they must be protected from encryption and deletion.
Test your recovery process. Quarterly DR drills meant everyone knew exactly what to do when disaster struck.
Patch management matters. The attack exploited a known VPN vulnerability. Regular patching prevents most ransomware attacks.
Don't wait for an attack to find out if your backups work.
Co-managed IT for Tampa Bay & St. Petersburg teams — we work alongside your in-house IT, not replace it.
Comprehensive protection including EDR, 24/7 monitoring, and incident response.
Proactive IT management with immutable backups included in every plan.
Find vulnerabilities before attackers do with our comprehensive security audit.
Get a free security assessment and learn how to protect your critical data.