Illustrative exampleManufacturing / Food Manufacturing

A commercial bakery's ransomware morning, contained to one laptop

A fake invoice opened in purchasing started encrypting files at 6:40 on a Tuesday. Managed detection cut the laptop off in four minutes, and the mixers never stopped.

This shows the kind of work we do. It is not a client engagement, and the business in it is invented.

Where it started

The problem

At 6:40 one Tuesday, an office laptop at a commercial bakery started renaming files. Somebody in purchasing had opened a fake invoice the afternoon before.

The laptop wasn't the worry. The recipe server was, along with the PC that sends batch weights to the mixers, and both shared a network with it.

What changed

What we did

The bakery was already on our managed detection service. The endpoint agent flagged the mass renaming within a couple of minutes, and the analyst on shift isolated the laptop before anyone at the bakery knew there was a problem.

Then came the slower work. We pulled the logs, found the invoice email and two more inboxes that had received it, and removed those copies before anyone else could click.

Forty-one files on a shared drive had been encrypted before isolation. All of them came back from the previous night's backup, which we restore-test every month for exactly this kind of morning.

Afterwards the batching PC moved onto a segment of its own, and the bakery's mail filtering gained a rule for invoices from first-time senders.

Built with

  • SentinelOne
  • Microsoft Defender for Office 365
  • Veeam
  • FortiGate

Services in this job

More on food manufacturing

Got a job like this one?

Tell us what's slow, fragile or stuck.

We'll tell you whether it's work we should be doing and what it would involve. Every quote is written for the job in front of us.

Talk to usMore work
  • What we arePlan, create, launch, maintain
  • What we areSentrello Premier Partner
  • What we areEvery quote written for you