You find out once it has spread.
-
Tuesday · 9:12am
Someone in accounts opens an invoice attachment from a supplier they recognise. Nothing appears to happen.
-
Tuesday · afternoon
It works through the shared folder quietly, one directory at a time. Nobody notices.
-
Wednesday · 8:30am
Nothing opens. Every file has been renamed, and there's a note demanding payment.
-
Wednesday to Friday
The backup drive was plugged in, so it got encrypted too. You rebuild from email attachments and paper.
Three days rebuilding. And no clear answer for clients about what was exposed.