One Invoice, Nine Days: How a Single Click Took Down a 32-Person Company
A minute-by-minute reconstruction of how a typical small business ransomware attack unfolds, and the seven moments where it could have been stopped cold.
Nobody at Pinecrest Design Group did anything reckless. That is what makes this story worth reading. The company is fictional, a 32-person engineering and design firm somewhere on the Front Range, but the sequence you are about to see is assembled from the way real small business attacks tend to unfold: one believable email, one ordinary employee, and a chain of events that runs for days before anyone notices.
Scroll through the timeline twice. First as the Unprepared company, with a password-only login, backups on the same network and nobody watching. Then flip the switch to Protected and watch the same attacker hit a different wall at every stage.
How to read Protected mode: each stage shows the defensive layer that would break the chain at that exact point. It is not a story of everything going right at once. It is defense in depth: any one of these layers could have ended the attack, and each one exists because the layer before it can fail.
The Invoice
The attacker: sends an email that looks like it is from a vendor Pinecrest really uses, with an overdue invoice and a link. The link opens a page that is a pixel-perfect copy of the Microsoft 365 sign-in screen. The bookkeeper is mid-task, the request is routine, and the sender looks right.
Unprepared
Nothing flags it. She types her email and password into the fake page, and the attacker now holds working credentials to her account. It took her eleven seconds.
Protected · Layer 1: Email filtering and one-click reporting
Advanced filtering catches many lookalike messages before they land. When one slips through, a visible Report Phishing button sends it to IT in a single click, and a trained employee who hesitates gets backup from a team that wants the report, not an apology.
The Login
The attacker: signs in to the bookkeeper's mailbox using the stolen password, from a location thousands of miles from Colorado, less than twenty minutes after the click.
Unprepared
A password is all the login asks for, so the door simply opens. There is no second check and no rule about where sign-ins can come from. The attacker is now inside the company's email as a trusted employee.
Protected · Layer 2: MFA and sign-in policies
A password alone is not enough. Multi-factor authentication and sign-in rules that challenge or block unusual locations and devices stop the login, and the bookkeeper's phone lights up with a prompt she did not request. She denies it, and IT is alerted. Honest caveat: MFA is strong, not magic. Some phishing kits can capture session tokens, which is exactly why five more layers follow.
The Quiet Rule
The attacker: creates a hidden inbox rule that quietly forwards or buries messages containing words like invoice, wire and payment, then starts reading months of email to learn who pays whom, who approves what, and how the company talks.
Unprepared
The rule is invisible to the bookkeeper and to everyone else. Nobody is looking at mailbox activity, so the attacker has all the time in the world to study the business.
Protected · Layer 3: Account and mailbox monitoring
A new forwarding rule created from an unfamiliar location is exactly the kind of event monitoring is built to catch. The account is locked, active sessions are revoked, the password is reset, and the attacker is out before they have read much of anything.
The Long Look
The attacker: emails coworkers from a genuinely trusted address, which makes the next phish far more convincing. Then they hunt for a way deeper: a saved credential, an admin login, the location of the backups. They install a remote access tool so they no longer depend on the mailbox at all.
Unprepared
Everything looks normal. On the file server sits a spreadsheet called Passwords.xlsx, including the admin login. The attacker finds it, takes it, and now controls the network. This quiet stretch is called dwell time, and in many real incidents it lasts days.
Protected · Layer 4: Endpoint detection and credential hygiene
Endpoint detection and response software flags the unfamiliar remote tool the moment it runs and isolates that computer from the network. There is no password spreadsheet to find, because credentials live in a managed vault, and admin accounts are separate and protected with MFA.
The Detonation
The attacker: picks the hour when no one is watching, because attackers commonly launch on nights, weekends and holidays. First they delete every backup they can reach. Then they start encryption across servers and workstations at once.
Unprepared
The backup drive was plugged into the same network and accessible with the same admin login, so it is wiped or encrypted along with everything else. Client files, project drawings, accounting data: locked.
Protected · Layer 5: Offsite, immutable backups
Backup copies are stored offsite with separate credentials and cannot be altered or deleted, even by someone holding an admin account. The encryption runs, and it does not matter. A clean copy is untouched and waiting.
The Discovery
The scene: employees arrive to find a ransom note on their screens. Nothing opens. Phones are ringing and clients are expecting deliverables.
Unprepared
The owner finds out when an employee holds up a phone with a photo of the screen. No one knows who to call first, whether to shut everything down, or what to say to clients. The first hours are spent improvising, and every hour of confusion is an hour of lost work.
Protected · Layer 6: A written incident response plan
The plan is on paper and everyone knows their role: who isolates systems, who calls the insurer and legal counsel, who talks to clients, and who owns the restore. Response begins in minutes, and the first hours are spent executing instead of arguing.
The Aftermath
The reality: the attacker also copied data before encrypting it and now threatens to publish it. The ransom demand has a countdown attached.
Unprepared
Pinecrest faces the worst kind of decision with the worst kind of information. Paying carries no guarantee of getting data back, or of it not being leaked anyway, and federal law enforcement generally discourages it. Rebuilding from scratch takes days and often weeks. Add legal review, possible client and regulatory notifications, an insurance claim, and clients quietly wondering whether to stay.
Protected · Layer 7: Tested recovery
Because restores have been tested before, not just assumed to work, systems come back from clean copies, credentials are reset, and the entry point is closed. The company is working again fast, the ransom question is far less painful, and the story is a bad week instead of an existential one.
Same attacker. Two very different endings.
The attack did not change between the two versions. Only the preparation did.
Unprepared Pinecrest
- One stolen password opened everything
- Days of undetected access
- Backups deleted along with the data
- Downtime measured in days to weeks
- A ransom decision with no good options
- Client trust on the line
Protected Pinecrest
- The login is challenged and blocked
- Suspicious activity flagged in minutes
- Clean, untouchable backups on standby
- A written plan and a team that knows it
- Recovery from tested restores
- Clients barely notice
Illustrative scenario. Real incidents vary in timing, technique and cost, and no set of defenses reduces risk to zero.
Which layers would catch it at your company?
Tap each layer you can say yes to with confidence. If you are not sure, that counts as a no.
Questions people ask after reading this
How long do attackers stay inside before encrypting files?
It varies widely. In many incidents attackers spend days inside a network mapping systems, collecting passwords and disabling backups before they launch encryption, while some attacks move much faster. That quiet period is the best window for detection.
Does multi-factor authentication stop phishing?
It stops a large share of password-theft attacks, but it is not bulletproof. Some phishing kits capture session tokens, and attackers sometimes wear users down with repeated prompts. MFA works best paired with sign-in policies, email filtering, endpoint detection and monitoring.
Why do backups fail during ransomware attacks?
Usually for one of two reasons: they are reachable from the same network and credentials the attacker has compromised, so they get deleted or encrypted too, or they were never tested and turn out to be incomplete. Offsite, immutable backups with regular test restores address both.
Should a business pay the ransom?
Federal law enforcement agencies generally discourage it, because payment does not guarantee data is returned or that it will not be leaked or reused. The real decision involves legal, insurance and operational factors, which is why an incident response plan needs to exist before an attack, not during one.
Find out which layers you're missing before someone else does.
ITGuys helps businesses across the Front Range, from Fort Collins to Denver and beyond, put these layers in place and keep them working. Talk to a real person about where your business stands today.
Talk to ITGuys
Recent Comments