14
A client's 'simple' data recovery turned into a ransomware nightmare
Last week, a regular customer in Springfield brought me a desktop that wouldn't boot. He said, 'Just get my photos back, I don't care about the rest.' The drive was encrypted with a .lockbit extension, a clear sign. I isolated it immediately on my offline bench. The timeline was scary; the ransom note said the countdown started three days prior when he clicked a fake invoice email. I explained we couldn't just 'recover' the data without potentially paying criminals, which I refuse to do. He hadn't had a backup since 2021. Now we're trying file carving tools on the encrypted drive, but it's a long shot. Has anyone else had a client bring in an already-infected system, and how do you handle that first conversation about the likely total loss?
4 comments
Log in to join the discussion
Log In4 Comments
sullivan.quinn27d ago
But what if paying is the only real choice left? I get what @craig.parker is saying about not funding more attacks, but that feels like a big picture idea when your client is losing everything right now. For some people, those photos or business files are their whole life, and if a few thousand dollars gets it back, that's a price they might need to pay. The hard truth is sometimes the data is just worth more than the principle.
6
kevinallen11d ago
What good is a principle when your life's work is locked up? Craig.parker is right about the bigger problem, but that's a future worry. The client's crisis is happening right now. If paying gets their family photos or business files back today, that's the choice they have to make. You can't ask someone to lose everything for a cause that won't help them.
8
Read an article where they said paying the ransom just funds more attacks. How do you even break that news to a client?
4
jamesc7927d ago
Man, that's rough. I had a guy last month who lost all his construction business invoices the same way. Telling him the data was just gone was awful. You watch their face fall and know there's nothing you can really do. It feels like you're delivering a death sentence for their family photos or their work files. That first talk is the worst part of the job sometimes.
2