Saved by the Backup: A St. Pete Retailer's Ransomware Near-Miss
At 6:47 on a Tuesday morning, the owner of Sunshine City Outfitters, a three-store outdoor retailer in St. Petersburg, walked into her flagship shop to find every register locked and a ransom note on the back-office PC. Files encrypted. Pay in crypto. Clock ticking. By 11:30 AM, her registers were ringing again, and she never paid a cent. Here's how that morning actually went.
The call#
What the owner didn't know when she dialed our incident line is that the fight had already started without her. Fifteen minutes earlier, the endpoint detection agent on the back-office PC had flagged mass file encryption, killed the process, and cut the machine off from the network automatically. Our overnight NOC analyst was already looking at the alert when her call came in. By the time she finished describing the ransom note, a technician was in his car.
Minute by minute#
Time | What happened |
|---|---|
6:32 AM | EDR detects encryption behavior on the back-office PC and isolates it from the network |
6:47 AM | Owner discovers the ransom note and calls the comTECH incident line |
7:05 AM | Technician on site; remote team begins sweeping every device across all three stores |
7:20 AM | Spread confirmed stopped at two machines: the back-office PC and one register it touched |
8:00 AM | Both machines wiped; restore begins from the immutable offsite backup taken at 2 AM |
11:30 AM | All registers live; flagship store selling again before the lunch rush |
End of day | Full operations restored; total data loss limited to four and a half hours of overnight files |
Why it worked#
EDR with automatic isolation. The infected PC was cut off in seconds, at 6:32 in the morning, when no human was watching the store. That's what turned a company-wide incident into a two-machine problem.
Immutable offsite backups. The attackers tried to find and delete the backups. They couldn't: the offsite copy is write-locked, so even a stolen admin password can't touch it.
Restores tested every quarter. Nobody was guessing whether the backup would work at 8 AM. We had restored from it, on a schedule, four times in the previous year.
Staff who reported instead of rebooting. The owner left the machines alone and called. Security awareness training is why that was her first instinct.
I always thought backups were an insurance policy I'd never use. Turns out it's the best money I've ever spent. - Owner, Sunshine City Outfitters
The takeaway#
Nothing in this story required luck. Detection, isolation, immutable backups, and rehearsed restores are standard parts of comTECH Shield, working quietly until the one morning they earn their keep. The only question worth asking is the one we'll help you answer for free: if this happened to you tomorrow at 6:32 AM, what would your Tuesday look like?
Stay in the loop
Get new posts in your inbox. No spam, unsubscribe anytime.
More to read
From Server Closet to Cloud: Bayshore Dental's Migration Story
Three locations, one overheating server closet, and a HIPAA audit on the calendar. How a Tampa dental group moved everything to the cloud over a single weekend, without canceling a single appointment.
How a Clearwater Law Firm Cut IT Downtime by 90%
Hartley & Voss was losing six billable hours a week to frozen screens and a dying server. Twelve months later, downtime is down 90 percent and the partners haven't thought about IT in months. Here's the play-by-play.