Ransomware hit us too — what we did in the first 24 hours, and what we did wrong

Mapping the NAS as a drive letter inside Windows was the single biggest technical mistake here. The backup repository should have been completely isolated from the primary authentication system (Active Directory), operated under a dedicated user account accessible only by the backup agent, and configured with immutable storage.

Definitely do not miss the official 72-hour notification deadline for KVKK. Even if you aren't sure whether data was actually exfiltrated, fill out the form on their site and submit a preliminary notification; otherwise, even if you recover your systems, you'll be hit with massive administrative fines down the road.

Before restoring that 16-day-old offline backup, make sure you rebuild the systems completely from scratch. Attackers usually infiltrate and lurk for 2-3 weeks before triggering encryption. If the attacker was already inside when that backup was taken, you might find yourself encrypted all over again the moment you restore it.

We went through this two years ago at our 120-person textile company. A colleague of ours panicked and paid the ransom; the decryptor they sent was corrupt, half the database couldn't be recovered, and they just lost the money. Never negotiate with them, as painful as it is restoring from a clean backup and manually re-entering the lost data is the safest way.

In our case, we lost 10 days of invoice and waybill data. An 8-person team worked around the clock for 4 days manually entering everything back into the system from physical paper invoices. The direct cost to the company in overtime and lost revenue was around 350.000 TL, but at least we didn't give a dime to the extortionists.

Reading this literally brought back all the stress I went through myself so sorry you're dealing with this. If it weren't for that external drive in the safe you'd be on the verge of shutting the company down. You can definitely say you dodged a bullet.

Quick incident response summary for similar situations: 1) Physically isolate the network but do not power down the servers, 2) Never connect offline backups to the existing network, 3) Do not restore from backup until the entry point is identified and patched, 4) File official notifications with KVKK and the relevant legal authorities.

mapping a nas drive directly to a pc like an external drive is a classic sme mistake unfortunately. anyway after getting burned the same way we switched to immutable cloud backups, only now we can actually sleep at night.

correct.

I've been dealing with this for a long time. If the gap between accounts receivable and accounts payable turnover days is widening, revenue won't save you.

I'm curious too.

The cheap-looking path usually ends up costing more later. Solutions that work at a small scale collapse when you grow; I learned this late.

If I were you, I'd go this route.

The most overlooked point about ransomware is this: The moment you depend on a single client, you no longer set the price.

If you don't write this down from the start, it leads to arguments later. Just leaving this note, it might be useful.

I felt relieved reading this answer, so it's not just me. Cutting your own salary is a temporary tactic; if it lasts more than six months, something will break.

If you post the result here, it will help others too.

I'll argue the opposite, don't get mad. When making a decision, first look at what data you have on hand.

If I were you, I'd go this route.

There is something to watch out for. When you try to change everything at once, nothing settles.

When making decisions, write down the worst-case scenario too, not just the best.

I went through the same thing.

I'm in the same situation, that's why I'm asking. honestly when you try to change everything at once nothing settles.

If you have questions, write them; Ill answer as best I can.