What is a ransomware attack — and what precautions are actually essential at our scale?

Attackers usually run port scanners looking for default ports like 3389 open to the web, then brute-force their way in. Once inside, the very first thing they do is wipe shadow copies. Never rely on system restore points for this reason. Check all port forwarding rules on your router immediately.

This happened at our 12-person textile office two years ago. An accounting colleague opened an attachment disguised as a shipping tracking document. Within half an hour, our accounting software's database was locked tight. We refused to pay the ransom because there's no guarantee they'll even hand over the decryption key. We had to roll back to a three-week-old backup sitting on an old external hard drive.

our accountant backs up to an external drive every friday afternoon, unplugs the cable and locks it in the safe. honestly cheapest solution and lets u sleep at night. anything left connected to the network gets wiped anyway.

Knock out these three items first thing Monday morning: 1) Close down any remote desktop ports facing the internet immediately. 2) Back up your accounting database onto a separate external drive that remains disconnected from the network. 3) Strip local administrator privileges from all office workstations and switch staff to standard user accounts.

Plenty of shops install an antivirus and assume they're untouchable, but security tools often fail to catch newly emerging ransomware variants for the first few days. Once your files are scrambled, an antivirus popup doesn't do you any good. The only thing that truly saves you is having a clean, untouched backup ready to deploy.

we have staff email the accounting files to their own peersonal inboxes as a backup does that protect us from ransomware or does that get encrypted too?

To answer the beginner's question: manually emailing small files might be a temporary band-aid, but it's not a viable long-term strategy. The biggest vulnerability for a machine shop is your CAD drawings and historical invoices. Until you set up rotated external drives and secure access behind the router, that anxiety isn't going away.

If you're going this route, sort this out first. anyway don't hesitate to ask; those who don't ask always pay more.

If you get three different answers on a topic the question was asked wrong. If I were you, I'd go this route.

looking at it as a process the picture changes.. then people defedn habits not processes... resistance comes from there.

Timely topic.

I went through the same thing two years ago. Most time waste accumulates in tasks waiting for approval.

Correct in theory, but it doesn't work that way in practice. People defend habits, not processes. Resistance comes from there.

Of course, it varies if your situation is different.

good call starting this thread but when making decisions write down the worst-case sceenario too not just the best.

if it's your first time, start small; scaling comes later then if you have questions, write them; I'll answer as best I can.

If I understood correctly, you're saying: If permission and scope aren't in writing, don't start that test.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. Good luck with that.

I'm in the same situation, that's why I'm asking. Everything goes well for the first three months; problems arise in the fourth.

Hope this helps.

There's one point I'm curious about. Just because everyone does it doesn't mean it's right.

Just leaving this note it might be useful.

Let me summarize the topic, since several different answers were given. If you scold false alarms, nobody will report again.

Of course, it varies if your situation is different.

Let me speak from the other side; I'm on the supplier side. The real issue isn't the number but what it's based on.

Correct me if I'm wrong.