How a Proactive Security and Backup Strategy Saved a Firm from a Ransomware Disaster
Ransomware attacks are getting more sophisticated, and with their multi-stage attacks, they are affecting more businesses and organisations across Australia. Experiencing a ransomware attack is more a question of "when" than "if." And when it happens, a proactive managed cyber security approach combined with a robust backup strategy is essential for quick recovery from an IT disaster.
In this case study, we will compare two companies: Firm A and Firm B.
Both faced a similar ransomware attack but experienced different outcomes due to their cyber security strategies. Their response shows the difference between a manageable disruption and a serious business threat, and why the level of managed security you have in place matters.
|
Organisation |
Firm A (Managed Security Basics) |
Firm B (Managed Security Proactive) |
|
Detection Time |
Next Day |
Real-time |
|
Downtime |
7 days |
Under 2 days |
|
Backups |
Encrypted but unrecoverable |
Isolated & fully restorable |
|
Recovery Cost |
Significant (data recovery + lost productivity) |
Minimal |
This complex malware compromises servers and use various methods to infiltrate and encrypt sensitive business data, while also deleting on-site and cloud backups. If not addressed promptly, this kind of ransomware attack could severely disrupt operations and cost the organisations both profit and reputation.
Here’s how each firm responded to the ransomware attack based on their respective cyber security and backup strategies.
Using SentinelOne and proactive monitoring, Firm B detected the ransomware in real-time.
The ransomware attempted to launch from the server but was blocked.
The attacker tried to bypass security by launching a new virtual machine to attack from the compromised server.
SentinelOne minimised the damage by initiating rollbacks and file restoration.
The ransomware attack was contained within hours with minimal disruption, despite its complexity.
Firm A did not detect the ransomware attack until the next day.
With no monitoring and prevention during out-of-office hours, the attackers had enough time to infiltrate Firm A's network overnight
There was no rollback feature, so they had to rely on backups for recovery.
The ransomware attack led to serious downtime and costly recovery work. It also made one thing clear: without proactive protection like Managed Detection and Response (MDR), the business was left far too exposed.
The attacker can't access the backup server because it wasn’t joined to the domain.
The NAS was only accessible via the backup server, so ransomware (or other types of cyber attacks) couldn’t access it.
On-site backups remained safe and ready to restore immediately.
Quick and easy recovery, with minimal downtime.
Firm A relied on a single server to manage everything, including backups.
The ransomware easily accessed the backups because they were on a domain server.
All data backups stored on server-attached HDDs were encrypted and unrecoverable.
Major data loss and delayed operational recovery + costly recovery.
Given the increasing frequency of ransomware attacks, taking a proactive approach to cybersecurity and backup strategies can significantly mitigate the impact of an attack. Similar to Firm B’s proactive method with isolated backups, they transformed a potentially devastating ransomware incident into a manageable event with little to no downtime.
In contrast, Firm A’s experience with Managed Security Basics shows that basic protection alone may not be enough to stop fast-moving attacks after hours, and that isolated backups are just as important as detection.
Although both Firms A and B had immutable backups, Firm B didn't need to use theirs. When Firm A's server-attached HDD backups could not be recovered, the immutable backup became their last line of defence and helped avoid further downtime and added recovery costs.
Proactive security and backup solutions are now essential for any SME, especially considering how frequently ransomware attacks target them.
Don’t wait for an attack to occur. Start implementing a proactive managed IT security plan today with your trusted IT professionals.
Check out our recent blogs below, or browse our full range of blog articles for more insights, guidance and support content.
Never worry about downtimes and the repercussions of cyber risks again.
Strengthen your cyber defences with an expert team of Australia-based IT experts, ready to reduce your IT security headaches.

IT isn’t supposed to distract you from the important stuff. It’s supposed to enable you to do more of it, more efficiently. And that’s our sole purpose at Office Solutions IT. Since 1996, we’ve been supporting Australian businesses with IT services that handle the complexity for you, so you can stay focused on running and growing your business. Get in touch to find out how we can help.
Call us on 1300 349 195
Email us
connect@osit.com
Schedule a call
©2026 Office Solutions IT. All Rights Reserved.
ABN 24 623 379 135