The call came on a Tuesday morning. A medium-sized business in Johannesburg had arrived at work to find every file on their server encrypted. A ransom note on every screen demanded payment in cryptocurrency within 48 hours.

They paid. And then they waited. And then they realised the attackers were not giving them their data back.

This is not an unusual outcome. It is, in fact, a common one.

How the Attack Happened

In this case, the entry point was a phishing email opened six weeks earlier. The attackers had been inside the network quietly for over a month, learning the layout, identifying the backup systems, and waiting for the right moment. When they struck, they encrypted not just the live data but also the local backups.

The business had no offsite backup. They had no incident response plan. And they had no IT support partner who was monitoring their network for unusual activity.

Why Paying the Ransom Is Not a Solution

• Attackers are criminals with no obligation to restore your data after payment
• Paying marks your business as one that will pay, making you a target for future attacks
• Even when decryption keys are provided, the restoration process is slow and often incomplete
• You have no way of knowing whether the attackers have retained copies of your data
• Payment funds further criminal operations

What Proper Protection Looks Like

Ransomware protection is not a single product. It is a layered approach:

• Offsite and cloud backups that are isolated from your main network so they cannot be encrypted in an attack
• Regular backup testing so you know recovery actually works before you need it
• Email filtering and staff training to reduce the chance of the initial infection
• Network monitoring to detect unusual activity before attackers reach their objective
• An incident response plan so you know exactly what to do if the worst happens

The Joburg Business Today

They rebuilt from scratch. It took four months, cost them several major clients, and the financial damage ran well into six figures. They now have a managed IT support contract, offsite backups, and a proper security posture. They wish they had done it before, not after.

Do not become a cautionary tale. Contact DelTrix Technology on 0716763026 or support@deltrixtech.co.za to make sure your business is protected before an attack, not after.