It's the last business day of the month at a small property management company in Baytown. Rent payments are posting, owner statements are due, and the office manager can't open a single file. Every folder on the server is full of documents with strange extensions, and a text file on the desktop explains how to pay to get them back.

What happens in the next few hours decides whether this becomes a bad week or a business-ending month. One of the biggest risks in those hours is trusting the wrong people.

Everyone on the other side has a sales pitch

Once files are locked, the attackers turn into salespeople. They offer a "discount" for paying fast. They promise to delete the data they copied. Sometimes rival criminal groups jump in, claiming they can unlock the files for less or that they'll punish the original attackers. There are also so-called recovery firms that advertise guaranteed decryption, then quietly pay the ransom themselves and mark up the bill.

The common thread is that none of these people answer to you. A criminal who promises to delete stolen data has no reason to actually do it. A decryption tool from an attacker may be slow, buggy, or only unlock part of what was taken. And any group that shows up offering a rescue is looking for a payday, not doing you a favor.

Paying doesn't close the door, either. A business that pays is now known as a business that pays, and sending money to certain sanctioned groups can create legal trouble of its own. That's a conversation for your attorney and insurer, not a decision to make alone at seven in the morning.

What actually gets a business back on its feet

Businesses that recover well have almost always done the unglamorous work ahead of time. Here's what makes the difference:

  • Backups the attackers can't reach. Attackers go after backups early. Copies that are stored offsite and immutable, meaning they can't be changed or deleted for a set period, are what let you restore without negotiating. Our data backup and recovery service is built around exactly that.
  • Restores you've actually practiced. A backup nobody has ever restored from is a hope, not a plan. Test a real restore a few times a year and write down how long it took.
  • Cloud data covered too. Microsoft 365 email, OneDrive, and SharePoint can be encrypted or wiped through a compromised account. They need their own backup.
  • Someone watching after hours. Many attacks start overnight or on a weekend. Round-the-clock monitoring of computers and sign-ins can catch early warning signs, like an odd login or a tool running that shouldn't be, before files get locked.
  • A one-page response plan. Who to call and in what order, with phone numbers printed on paper, because email and the file server may be down.

The first hour, if it happens to you

If you ever find yourself where that Baytown office manager was, here's a sensible order of operations:

  1. Disconnect, but don't power off. Unplug network cables and turn off Wi-Fi on affected machines. Leaving them running can preserve evidence that helps investigators.
  2. Call your IT provider first, then your cyber insurance carrier. Many policies require prompt notice and the use of approved responders.
  3. Don't contact the attackers, or anyone offering to negotiate or decrypt for you, until your IT team, insurer, and attorney have weighed in.
  4. Switch to phones for internal communication in case email has been compromised.
  5. Report it. File a report with the FBI's Internet Crime Complaint Center at ic3.gov. Depending on your industry and what data was involved, you may also have duties to notify clients or regulators.
  6. Write everything down. Times, what you saw, who you called. It helps both the insurance claim and the investigation.

A quick self-check

Ask yourself three questions today. When was our last successful test restore? If an attacker got hold of an administrator password, could they also delete our backups? Does everyone know who to call if the screens go dark?

If you can't answer all three with confidence, that's worth fixing now, while it's still a planning exercise rather than an emergency. We help Houston-area businesses build backup and response plans that hold up on a bad day. Set up a discovery call and we'll walk through yours with you.