Customer had a problem accessing files after an Easter weekend, an employee remembered opening a link to a website the week before and downloading some files that were though to be from a customer, seems to have been a Ransomware attack over the Easter weekend all files stored on the network had been encrypted by the Ransomware virus and now could not be opened.
All the network files were stored on a Synology NAS device which had Snapshot Replication enabled so that every hour a snapshot was taken of all Company data files.
The Ransomware virus was removed from the infected computer, other computers were checked and all were found to be free of the virus.
The encrypted Company data files were deleted and the Snapshot files were restored from a Snapshot taken on the Thursday before the files were started to be encrypted.
All files required by the customer for that days work were recovered first which took about 30 minutes, then the rest of the Company data files were restored, all remaining data files were restored by the end of that day.
All Company Data files were protected by Synology Snapshot replication and quickly recovered. Additional backups also existed (Synology Hyper Backup & Drive) but were not required as Snapshot replication recovered all data. Users were given additional training about clicking on links and additional email link protection was added to the email system.