Tuesday phishing email. Friday encryption. Eleven days to find out the backups worked.

Tuesday 9:14 AM. The bookkeeper, a 14-year employee with finance and HR responsibilities, received an email styled as a federal court filing notice. The attachment opened a fake login page that asked her to re-authenticate her firm email to download the filing. She did. Two minutes later her credentials were on a Telegram channel and an attacker in another country was logged into her mailbox.

Tuesday afternoon. The attacker did nothing visible. They read her email folders to understand who she emailed and what she had access to. They watched her forward an invoice to a partner. They noted she could connect to the firm's file server, the practice management system, and the accounting system.

Wednesday and Thursday. The attacker moved laterally. Using credentials they harvested by installing a small tool on her workstation, they reached the IT admin's account, then a domain administrator account. They mapped every file share. They identified that the backup server was on the same domain as production — a single set of credentials reached both. They quietly disabled the backup job for the most recent four nights. Nobody noticed because the backup software still reported "success — last run Tuesday."

Friday 4:40 PM. A paralegal tried to open a deposition transcript and got a file extension she had never seen. Within ninety seconds three attorneys reported the same problem from different floors. The managing partner walked into his office to find a ransom note open on his screen demanding $400,000 in Bitcoin. The firm's IT manager — one full-time person and a part-time contractor — pulled the plug on every server he could reach. By 7 PM the firm was effectively offline.

Saturday.The insurance carrier's breach hotline routed the firm to a breach coach, a DFIR firm, and a ransomware negotiator. The DFIR firm began forensics; the negotiator opened a back-channel to the ransomware crew to buy time. The partners assembled in a conference room with no working computers and started writing client notifications by hand.

Sunday through Wednesday. The IT manager and the DFIR firm worked through backup tapes. The first restoration attempt failed — the most recent backup was from Tuesday night, after the bookkeeper's account had been compromised but before the encryption ran, and the restored files still contained the attacker's footholds. The second attempt failed for a different reason: a corrupted index file the backup vendor had flagged six months earlier in a quarterly report that nobody had read.

Thursday — day 7. The third restoration attempt — from a backup five days older than the attacker's entry — finally produced a clean, mountable copy. The firm lost five days of billable work, time entries, document edits, and email. Two partners had been deep in discovery production on a major case; their week of redlines had to be re-done from scratch.

Day 11. The firm was operational again, on a rebuilt environment with new domain controllers, new backup architecture, enforced MFA, and an external SOC monitoring 24/7. Six weeks later, three clients had quietly moved their matters elsewhere. Three more left during the next renewal cycle. Insurance covered roughly 52 percent of the $2.4M total. The firm absorbed the rest.

First 24 hours — containment. On engagement, the first thing we do is isolate the blast radius. Every endpoint and server gets either disconnected or quarantined under EDR. We stand up an out-of-band communication channel (so the partners can actually coordinate without using compromised email), and we walk the attacker's timeline backwards from the encryption event to the first foothold.

Days 2 to 4 — forensics and backup triage. We work in parallel: one team confirms which backup snapshots predate the compromise and are safe to restore; another team identifies every account the attacker touched and every system they reached. The question we answer for the owner: which backup is the latest one we are willing to bet the firm on. That answer is rarely the most recent.

Days 4 to 8 — rebuild, not restore. For a ransomware event of this scale we do not restore to the existing environment. We rebuild domain controllers from clean media, force every account through a credential rotation, enforce MFA on every identity (not just enable — enforce, with no exceptions), and bring up the file server, practice management, and accounting systems on the new identity plane.

Days 8 to 11 — operational handoff. We move the firm from emergency mode into ongoing managed detection and response. An external SOC begins 24/7 monitoring with documented escalation paths. Backups move to an architecture where credentials that reach production cannot reach backup storage — and we test a real restore on day 11.

Week 6 — bar and client notifications. We coordinate with breach counsel on state bar notification, client disclosure letters that comply with attorney professional-conduct requirements, and the insurance carrier's evidence package. Client calls are scripted with breach counsel so that what gets said is what gets said.

Ongoing. The firm moves to a quarterly cadence: tested restores from backup, phishing simulations against the staff most likely to be targeted, MFA attestation, and a board-grade summary the managing partner can hand to the insurance carrier at renewal.