Experience

Ransomware recovery for a national distribution business

Co-led Complete Retail and distribution

Led the technical recovery workstream alongside the major incident manager

A national distribution business with a branch network was hit by ransomware that reached Active Directory, Citrix and core server workloads. Its branches depend on central IT to trade, and it was clear early on that this was not an isolated problem.

The major incident manager ran the overall incident and customer engagement. I led the technical recovery workstream alongside them. That meant coordinating technical decisions, prioritising the recovery, guiding the engineers and making sure the right specialists were involved at the right time. I also translated between the technical teams and the wider group of stakeholders.

The hardest call came first. Our team recommended containment before continuity, isolating systems and restricting connectivity, which meant more disruption in the short term to protect what could be recovered and stop the spread. The customer’s leadership accepted it. We also recommended bringing in forensic specialists early, so that recovery rested on evidence rather than assumptions. I worked with our cyber security team to confirm systems were safe before they returned to production.

Updates went out hourly at first and then twice a day. In each one I kept facts, assumptions and hypotheses separate, so leaders knew how much weight each statement could bear. Services came back in an agreed order of business priority over several days, through a mix of restores, forensic validation and selective rebuilds.

Afterwards I worked with the other major incident managers on how ransomware is tracked once the P1 phase ends. Recovery from ransomware runs for days, and the long tail needs ownership and handovers of its own.

Lesson. Successful backups and successful recovery are not always the same thing.