Service A: Incident five

Friday 2pm

Over lunch all of computers in the service begin to stop working. They show a message stating that files have been encrypted and that you must pay a ransom to decrypt them.

• Files on the shared drive have also been encrypted.
• Work has ground to a halt.
• Attempts overnight by your IT provider to recover the files fail after the backups are discovered to be faulty.