A 35-person full-service CPA practice in Bergen County, New Jersey — handling individual returns, business advisory, payroll, and bookkeeping for over 400 active clients under IRS and state tax authority regulations.
Staff affected
To full containment
Client data recovered
Ransom paid
The Challenge
On a Tuesday morning during peak tax season, the firm’s office manager arrived to find three workstations and the primary file server displaying ransomware encryption notices. QuickBooks files, completed client tax returns, and years of financial records were locked. The infection spread via a phishing email that bypassed basic antivirus. The firm had no incident response plan, no managed security, and their NAS backup had not been tested in over two years — and had itself been partially encrypted. Paying the ransom was not an option: the cyber insurance policy required documented evidence of a recovery attempt before any claim consideration.
What Solved IT Did
Solved IT was on-site within two hours. We immediately isolated affected machines from the network, identified the infection vector, and began forensic documentation for the insurance claim. The file server was restored from a clean offline backup that predated the infection; all client tax files were recovered and verified against the firm’s own records. Following incident remediation, we deployed Managed Detection and Response across all endpoints, implemented a verified cloud backup schedule with weekly tested restores, replaced the local NAS with an air-gapped cloud backup system, and ran a firm-wide security awareness training session.
The Results
- Ransomware fully contained in 4 hours with no spread beyond the initially infected machines — all active client work preserved
- 100% of client data recovered from clean backup — no ransom paid, no confirmed data exfiltration
- Insurance claim fully documented and approved — forensic report and recovery evidence accepted by carrier
- MDR deployed on all 35 endpoints — real-time threat detection and response active 24/7
- Backup tested and verified monthly — air-gapped cloud copy replacing the failed NAS with documented restore confirmations
- Zero recurrence in 18 months — phishing simulation results improved from 41% click rate to under 5%
