Tuesday, 11:14 PM

Marcus Chen is the managing partner of a 22-person accounting firm in North Scottsdale. He’s wrapping up a client proposal when his screen goes dark. Then a message appears.

White text on a black background. A file counter showing 47,000 encrypted documents. A Bitcoin address. A deadline: 72 hours.

His first call is to his office manager. His second is to a cell number he has for a “computer guy” who’s handled IT for the firm for four years on a part-time basis.

The phone rings seven times. No answer.

Tuesday, 11:47 PM

Marcus finds an IT company through a Google search: “IT emergency Phoenix.” The company that answers tells him their emergency rate is $375 per hour, minimum four hours, and they can have someone on-site by 7 AM. He takes the appointment.

What Marcus doesn’t know yet: the attackers have been inside his network for 19 days. They entered through a phishing email clicked by a junior associate who used the same password for a personal account that had already been breached. They’ve been quietly mapping the network, identifying backup locations, and waiting for the right moment.

The right moment was tonight.

Wednesday, 7:23 AM

The IT consultant arrives and begins assessment. Within 45 minutes the picture is clear:

•       The firm’s primary file server is fully encrypted. All client files, all tax returns, all correspondence.

•       The backup server — which was on the same network segment — has also been encrypted.

•       The QuickBooks server is encrypted. Billing is down.

•       The practice management system is encrypted. Every appointment, every engagement letter, every time entry.

•       The offsite cloud backup exists. But no one has tested it. The consultant tries to initiate a restore. It fails. The backup job has been silently erroring for three months.

Marcus sits in his conference room and does a calculation. Three hundred clients. Tax season in six weeks. Zero access to any client file.

Wednesday, 9:15 AM

Marcus calls his attorney, who immediately calls the firm’s malpractice carrier. The malpractice carrier connects him to the cyber insurance carrier.

Except Marcus doesn’t have cyber insurance. He had a general business owner’s policy and assumed it covered “computer stuff.”

It doesn’t.

Wednesday, 11:30 AM

The IT consultant delivers a hard assessment: without working backups, meaningful data recovery without paying the ransom is unlikely. The encrypted files use a modern ransomware variant. There is no known decryptor.

Options:

1.     Pay the ransom ($185,000 in Bitcoin) and hope the decryptor works.

2.     Attempt to reconstruct files from email threads, client copies, and whatever was saved locally on workstations.

3.     Engage a forensics firm at significant additional expense for a thorough investigation before deciding.

Marcus calls a forensics firm recommended by his attorney. Their earliest availability is Thursday. Their retainer is $25,000.

Wednesday, 2:00 PM

The staff meeting is difficult. Twenty-two employees are effectively unable to work. Marcus tells them to go home. He doesn’t know when they’ll be back at full capacity.

He also has to make decisions about client notification. His attorney tells him that under Arizona law — ARS § 18-552 — if personally identifiable information was accessed, he has 45 days to notify affected individuals. He needs to determine whether client social security numbers, financial data, or other covered information was in the encrypted files.

The answer, obviously, is yes. It was an accounting firm. Client tax data is the entire business.

Wednesday, 5:30 PM – Thursday, 8:00 AM

Marcus doesn’t sleep. He’s on the phone with his attorney, his accountant, his bank, and his largest clients. Three clients call him before he calls them — word has spread. Two of them ask pointed questions about whether their data was compromised. One says he’ll be “re-evaluating the relationship.”

His bank freezes the firm’s wire transfer capability as a precaution while the incident is active.

Thursday – Friday: The Forensics Investigation

The forensics team arrives Thursday morning. Over 36 hours, they determine:

•       The initial compromise occurred 19 days earlier via a phishing email.

•       The attacker used a publicly known technique to escalate from a standard user account to domain administrator.

•       No MFA was in place on any system. The attacker moved freely once inside.

•       The backup system’s error logs had been generating alerts for three months that no one was monitoring.

•       The ransomware group has a known history: they frequently sell stolen data on the dark web regardless of whether the ransom is paid.

That last finding changes everything. Even if Marcus pays the ransom and recovers his files, there is a meaningful probability that client data has already been exfiltrated and will be sold or published.

The Final Accounting

Six weeks after the incident, Marcus tallies the damage:

Four clients left the firm. The junior associate whose credentials were stolen resigned. Marcus is facing a bar inquiry related to client data protection.

What Would Have Changed This Story

This entire incident was preventable. Four controls — none of them expensive relative to the outcome — would have broken the attack chain:

•       MFA on all accounts: The attacker’s stolen credentials would have been useless. Full stop.

•       Monitored backup with off-site isolation: A clean, tested backup would have made the ransom payment unnecessary and recovery a matter of days, not weeks.

•       Security awareness training: The phishing email that started everything had detectable characteristics. A trained employee likely catches it.

•       EDR on endpoints: Modern endpoint detection would have flagged the attacker’s lateral movement techniques before the ransomware was deployed.

Marcus’s IT provider — a part-time consultant working without monitoring tools, without documentation, and without an SLA — couldn’t have detected the intrusion. He wasn’t watching.

That’s the difference between a managed security partner and a break-fix vendor. One of them was watching Marcus’s network at 2AM on the night the attackers moved. The other one didn’t answer the phone.

AEGITz clients have documented incident response plans, 24/7 monitoring, and cash-backed ransomware guarantees. If you’d like to understand what it would actually take to protect your Phoenix business from this scenario, schedule a no-obligation discovery call.