A ransomware attack reportedly helped put an unnamed small construction firm out of business after it encrypted both the company’s old, unpatched Windows server and the external drive attached as its only backup. In a separate incident, suspicious sign-in monitoring helped stop an attacker who had stolen credentials and an SMS code through a fake Microsoft 365 login page. The incidents show two different risks: losing access to business records and losing control of an account.
What happened to the construction firm that closed?
In an October 8, 2026 report, LavX News recounted cybersecurity consultant Dave Hatter’s account of a small construction firm that sought IT help after an attack. Hatter said a new CFO had contacted his consultancy, Intrust IT, about hiring it, but the owner rejected the proposal as too expensive. Three weeks later, a local accountant asked Hatter for help after ransomware encrypted an old, unpatched Windows server holding important business data.
As an Amazon Associate I earn from qualifying purchases.
The firm’s external backup drive was connected to that server and was encrypted too. According to the account, the owner could no longer pay employees or determine who owed the business money, and the company closed within months. Hatter said he could provide only general guidance and did not know whether the company paid a ransom. The report does not name the company or give its location or the attack date. LavX News’ account of the closure
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This is an attributed case account, not an independently audited investigation. The sequence does not establish that rejecting one security proposal alone caused the closure. The reported operational failure was that both the production server and its only connected backup became inaccessible; the report does not provide financial records or an independent confirmation of the company’s condition before or after the attack.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Why did the backup fail?
The drive was a backup in name, but not an independent recovery copy: it remained attached to the system ransomware encrypted. If a backup is reachable from a compromised or encrypted machine, the same incident may affect both the working data and the copy intended to restore it.
For a small firm, the useful question is not simply whether a backup exists. It is whether a clean, usable copy remains available if the server and devices connected to it are compromised. A recovery plan should identify where those copies are kept, how they are protected from changes or deletion by an attacker, and how the business would restore the records it needs to operate.
Rank #2
- Easier-Than-Ever Setup — Convenient and easy router management via web browser or the ASUS ExpertWiFi mobile app through Bluetooth setup.
- VLAN for Added Security —Each of the Ethernet ports can be assigned to one or more VLAN IDs that provides additional security for your business.
- Up to 3 WAN Ethernet Ports – 1 gigabit WAN port and 2 gigabit WAN/LAN ports with load balancing optimize multi-line broadband usage.
- Backup WAN for Stable Connectivity –The USB port can be used as a backup WAN by connecting it to a mobile phone with hotspot to maintain a reliable internet connection.
- Commercial-Grade Network Security and VPN — Secure public WiFi connections with Safe Browsing and VPN features. Enjoy a free-subscription ASUS AiProtection Pro, including robust intrusion prevention system (IPS) features like deep packet inspection (DPI) and virtual patching to block malicious traffic.
How did the other attack steal an SMS code?
The second account involved companies in landscaping and construction. The report says attackers first compromised an executive’s email at one company, then used that company’s domain to send convincing requests for proposals to another. The messages asked recipients to click a download button and reportedly had no obvious grammar errors.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe link led to a fake Microsoft 365 sign-in page. When a recipient entered login details and an SMS one-time code, the page relayed the information through a proxy login to Microsoft. The code was genuine, but the victim entered it into an attacker-controlled page, allowing the attacker to use it during the real sign-in. A message that appears to come from a known business contact can therefore still lead to credential theft.
Rank #3
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
Hatter said monitoring flagged an anomalous sign-in and the attacker’s session was revoked within minutes. That is the consultant’s description; the report does not identify the companies or quantify losses. The account describes a contained account compromise, not a second company suffering the same ransomware attack and escaping it. LavX News’ account of the phishing incident
What can a small construction business learn from the incidents?
Keep recovery copies separate from production
Maintain backup copies that an attack on a server cannot simply encrypt along with the working files. Decide who can access or change each copy, and periodically verify that important records can actually be restored. The practical measure of a backup is successful recovery, not merely a completed backup job.
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Use phishing-resistant sign-in where available
Hardware security keys and passkeys are phishing-resistant options that can reduce the risk of credentials being handed to a lookalike login page. Compatibility depends on the account, service, and device, so check what the business’s systems support. A security key or passkey addresses account authentication; it does not protect server data or replace backups.
Monitor sign-ins and prepare to revoke access
Review alerts for unusual sign-ins and have a clear response for disabling sessions and resetting credentials if an account is compromised. In the reported phishing case, monitoring and session revocation were the measures Hatter said stopped the attacker’s access.
Best Value
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
What does a separate recovery example show?
A CTERA vendor-published customer case study describes S.J. Louis Construction recovering from two ransomware incidents using nightly backups, a local copy, and cloud replication managed by Earthbend Technology. The account says the company rolled back and restored data. This is a vendor’s customer story, not independent testing, but it illustrates a different recovery design from a single drive attached to the server being protected. CTERA’s S.J. Louis Construction case study
The case study quotes IT Manager Rob Svendsen: “If it weren’t for CTERA technology and Earthbend managed services, ransomware would have been a devastating and potentially business-closing catastrophe.” Treat that as a customer statement published by the vendor, not as a general guarantee of recovery.
What remains unknown?
The reporting does not establish the failed firm’s name, location, exact attack date, initial access route, ransomware group, ransom demand or payment, or financial condition before the attack. It also does not independently confirm the closure. For the phishing incident, the companies are unnamed and the full financial or operational impact is not described. Neither account provides a basis for estimating how often these events occur or what losses they caused.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
