This is a fictional account based on real patterns drawn from Canadian cybersecurity incident reports and data recovery statistics. Names and details are invented. The consequences are not.
7:48 AM
Diane unlocks the front door of her family law practice in Hamilton, Ontario. Forty-three active clients. Seventeen years of files on the server in the back room. Her computer screen is already on. The wallpaper is gone. White text on a black background: YOUR FILES HAVE BEEN ENCRYPTED. Pay 3.2 Bitcoin within 72 hours.
8:12 AM
Marcus, her IT consultant, arrives. The ransomware had encrypted the backup drive too — it was connected to the network, it was accessible, it was gone. Their Dropbox Business account had synced every encrypted file the moment the ransomware touched them. Both copies of the data. Both inaccessible.
Recovery Options
(1) Pay the ransom — no guarantee the decryption key works. (2) Sector-level data recovery — expensive, slow, incomplete at best. (3) Restore from backup — no viable backup exists.
11:00 AM
Diane calls clients with upcoming court dates. One client — in the middle of a contested custody proceeding with a hearing in four days — goes quiet on the phone in a way that feels like the beginning of a Law Society complaint. Her PIPEDA breach notification obligations are now active. Forty-three clients. Marcus starts a list.
2:45 PM
Cybersecurity firm quote: $18,500 to $27,000. Timeline: two to three weeks before any data might be recovered — if at all.
What a Different Decision Would Have Changed
- Offsite backup physically and logically separate from the office network
- Immutable backup — a copy ransomware cannot modify or delete even with admin credentials
- Versioned backups with at least 30 days of recovery points
- Regular restore tests — not just backup confirmation, but actual tested recovery
- Canadian-jurisdiction storage for client files that deserve every layer of protection
The backup she could have had costs less per month than the coffee she buys for client meetings. She thinks about that often.