Our analysts saw files being encrypted on one laptop at 11:40 pm. We isolated it within eight minutes, stopped the spread and restored the affected files from a locked backup.
The firm was working again by 6 am. We then rebuilt their defences and trained every member of staff.