Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →An unnamed construction company reportedly lost access to its old server and its only backup after a ransomware attack, then closed within months. The account, attributed to cybersecurity consultant Dave Hatter, illustrates the danger of leaving backups connected and untested—but it does not establish that declining one security proposal alone caused the company to fail.
What reportedly happened to the construction company
According to the report, the company’s CFO contacted Intrust IT about hiring the consultancy. The owner declined the proposal as too expensive and reportedly said an informal IT contact was enough. Hatter later recalled the owner saying, “We got a guy, my brother’s uncle’s cousin does my IT, don’t need you guys.” That remark is attributed to Hatter; the report does not present it as a direct interview with the owner.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Smart Keeper USB-C Port Locks with Key, 4 Blockers 1 Key | $34.82 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
About three weeks later, an accountant reportedly asked Hatter for help after the company suffered a ransomware attack. The report says attackers encrypted an old, unpatched Windows server and an external backup drive that was connected to it. Hatter described the consequence: “Their entire backup is this external drive, which, of course, is now encrypted.”
With the server and backup unavailable, Hatter said the company could not pay employees or determine who owed it money. He said he did not learn whether it paid a ransom. The report says the business closed within months, but gives no audited financial details or independent evidence establishing that the attack was the sole cause. The company and its location are not named, and the account has not been independently corroborated here.
#1 Best Overall
- Bundle: 4 locks + 1 key.
- Easy to Use: It can be installed by hand.
- All-Purpose Key: A common key can be used to unlock 9 different products within the Essential series.
Why a connected backup can fail alongside the server
A backup drive can preserve data against hardware failure, but it is not a reliable recovery copy if it remains accessible to the system being attacked. Ransomware may encrypt or delete accessible backups as well as production files. In this account, the external drive was connected to the old server, so it was reportedly encrypted too.
CISA’s #StopRansomware Guide recommends keeping backups offline and encrypted, and regularly testing that they are available and intact in a recovery scenario. Those are distinct safeguards: isolation helps keep an attack from reaching the backup, while testing checks that the organization can actually restore from it.
| Backup practice | What it changes |
|---|---|
| Connected drive | Convenient to access, but may remain exposed to ransomware affecting the connected system. |
| Offline or otherwise isolated copy | Less directly reachable from an infected system; CISA recommends offline backups. |
| Regular restoration test | Checks availability and integrity by practicing recovery, rather than assuming a backup will work. |
What a small business can do differently
Protect recoverable copies of critical data
- Keep critical-data backups offline or otherwise isolated from everyday systems, and encrypt them.
- Test availability and integrity regularly by restoring data in a recovery scenario.
- Make sure the backup plan covers the business records needed to resume operations, not only files that are easy to copy.
Reduce account and system exposure
CISA recommends phishing-resistant multifactor authentication (MFA), especially for email, VPNs, and accounts with access to critical systems. Its guidance also calls for patching and appropriate email filtering. These are general recommendations; the report does not establish how the unnamed construction company was compromised.
A hardware security key, such as a YubiKey, is one example of a phishing-resistant MFA option; passkeys are another example named in the report. A key is not a complete security program, and compatibility and deployment requirements matter. Check that the services and devices the business uses support the chosen method, and plan how users will enroll and recover access.
Set expectations with an IT or backup provider
CISA advises organizations to consider the cyber hygiene of third parties and managed service providers, including providers responsible for backups. Ask who controls backup access, whether copies are isolated, how restoration is tested, and what help is available during an incident. This is a category-level recommendation, not an endorsement of any particular provider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A separate phishing incident—and a different lesson
The report also describes a separate case involving two companies in landscaping and construction. Attackers reportedly used a compromised executive email account to send plausible messages directing recipients to a fake Microsoft 365 login page that captured credentials and a one-time code. The report says a client’s TarBot software flagged anomalous sign-in telemetry and revoked the attacker’s session within minutes.
Hatter recommended phishing-resistant MFA, including hardware keys such as YubiKey and passkeys. This is a separate anecdote: the report does not say that the ransomware-hit construction company used or lacked those defenses. Nor does one response demonstrate that a single tool will prevent every account compromise.
What this account can—and cannot—show
The reported sequence is stark: a security proposal was declined, ransomware struck about three weeks later, the server and connected backup were reportedly encrypted, and the business closed within months. But the account names neither the company nor its location, and offers no independently documented forensic timeline or financial record. It cannot establish that the company’s decision caused the attack or, by itself, caused the closure. Its practical value is narrower and clearer: a backup that an infected system can reach may not be a usable backup, and recovery should be tested before an emergency.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
