What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A reported ransomware attack left an unnamed construction company without access to its old server and the external drive it used as its only backup. The company reportedly closed within months, but the account does not establish that the attack alone caused the closure. Its clearest lesson is practical: keep backups isolated from systems they protect, test that they can be restored, and secure important accounts against phishing.
What happened to the construction company
According to a report quoting Dave Hatter, a cybersecurity and compliance consultant with Intrust IT, the company’s CFO contacted the consultancy about hiring it. The owner declined the proposal as too expensive and reportedly said, “We got a guy, my brother’s uncle’s cousin does my IT, don’t need you guys.” That is a secondhand quotation attributed to Hatter, not a direct interview with the owner. The report says the ransomware attack happened about three weeks later. Read the report.
Hatter said attackers encrypted an old, unpatched Windows server and the external backup drive connected to it. “Their entire backup is this external drive, which, of course, is now encrypted,” he said. With the server and backup unavailable, the company reportedly could not pay employees or determine who owed it money. Hatter said he did not learn whether it paid a ransom.
The report says the business closed within months. It names neither the company nor its location, and this account was not independently corroborated in the available reporting. No audited financial details or independent evidence establish that ransomware was the sole cause of the closure. The short interval between the declined proposal and attack is a reported chronology, not proof that turning down that particular provider caused the outcome.
#1 Best Overall
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
Why a connected backup may fail when it is needed
A backup drive can hold a copy of important files and still be exposed to the same incident as the computer or server it is meant to protect. When it remains connected, ransomware may be able to reach and encrypt or delete it as well. CISA’s #StopRansomware Guide recommends offline, encrypted backups of critical data and regular testing of backup availability and integrity in a recovery scenario.
| Approach | What it changes | What to check |
|---|---|---|
| Connected drive | Convenient access, but malware that can reach the server may also reach the backup. | Whether the drive is exposed to the same accounts, systems, or network as the data being protected. |
| Offline or otherwise isolated backup | Reduces the chance that an attacker operating through a compromised system can alter the backup. | That copies are encrypted, kept separate from routine access, and available when needed. |
| Restore testing | Checks whether backup data can actually be recovered, rather than merely confirming that a backup job ran. | Availability and integrity in a recovery scenario, as CISA recommends. |
“Offline” is not a guarantee by itself: the organization still needs dependable copies and a way to restore them. A business should identify its critical data and recovery needs, then test the process rather than assume that a drive containing files is a usable backup.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What a small business can change
Protect the recovery path
- Maintain offline, encrypted copies of critical data, following CISA’s guidance.
- Test that the copies are available and intact, and that staff can restore data in a recovery scenario.
- Make sure whoever manages backups—including an outside IT provider—follows appropriate backup practices. CISA advises organizations to consider third-party and managed service provider cyber hygiene.
Reduce the chance that an account compromise becomes a foothold
CISA recommends phishing-resistant multifactor authentication (MFA), particularly for email, VPNs, and accounts with access to critical systems. It also recommends patching and appropriate email filtering. These are general preventive measures; the report does not establish how the unnamed construction company was compromised.
Hardware security keys, such as YubiKey devices, and passkeys are examples of phishing-resistant MFA cited in the report and CISA guidance. A key is one control, not a complete security program. Before choosing one, check compatibility with the business’s email, identity provider, devices, and account recovery process, then plan how staff will enroll and use it.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
A separate phishing case—not the same incident
The report also describes a distinct phishing incident involving companies in landscaping and construction. Attackers reportedly used a compromised executive email account to send plausible messages linking to a fake Microsoft 365 sign-in page, which captured credentials and a one-time code. The report says a client’s TarBot software flagged anomalous sign-in telemetry and revoked the attacker’s session within minutes.
This is a separate anecdote; it does not show that the ransomware-hit construction company used or lacked the same defenses. Its relevance is narrower: stolen credentials and one-time codes can put accounts at risk, which is why CISA specifically recommends phishing-resistant MFA for important services.
Quick Recap
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
