An entire city back to paper and spreadsheets
On May 7, 2019, the city government of Baltimore, in the United States, was hit by the RobbinHood ransomware, and a large share of municipal systems went offline within hours. As reported by the specialized technology press, the administration chose to shut down servers to contain the spread, a drastic decision that turned a security incident into the operational shutdown of an entire city (BleepingComputer).
What became public is striking in its scope. Corporate email, payment portals, water billing systems, and real estate transaction processing were unavailable for weeks, forcing public employees back to paper and manual spreadsheets. Roughly 1,500 real estate transactions were stalled, with families and businesses waiting on records that depended on systems that simply would not respond (Ars Technica).
Os criminosos pediram aproximadamente 13 bitcoins, algo em torno de US$ 76 mil à época, e a administração decidiu publicamente não pagar. A recuperação se arrastou por meses, com sistemas sendo reconstruídos e restaurados em etapas, e o custo estimado do episódio chegou a US$ 18,2 milhões, sendo cerca de US$ 10 milhões em recuperação e US$ 8,2 milhões em receita perdida ou adiada.
The arithmetic of this case deserves the attention of any decision-maker, because the amount demanded by the criminals represented less than 0.5% of the final accounted loss. No public report details exactly what failed inside the municipal structure, and speculating about it would be irresponsible. The value of the episode lies elsewhere: it is a rare, well-documented record of what happens to an operation when access to its own systems disappears from one moment to the next.
The vectors that incidents like this typically exploit
Compromised credentials and poorly configured remote access are among the most frequent entry points. A remote desktop service exposed to the internet, an administrative account with a password reused from another system, or a vendor access that remained active after the contract ended is enough for an attacker to walk in through the front door, without exploiting any sophisticated flaw. Verizon's Data Breach Investigations Report notes that the human element, including credential misuse and social engineering, was involved in 68% of the breaches analyzed. Without multi-factor authentication (MFA, the requirement of two or more proofs of identity before granting access), a password leaked on any other service becomes a master key.
The absence of network segmentation turns a localized incident into a full-blown crisis. When workstations, application servers, databases, and backup repositories coexist in the same logical space, with administrative credentials valid throughout the environment, an attacker who compromises a single machine moves laterally until reaching what really matters. Sophos's State of Ransomware report records that in 94% of attacks the criminals attempted to compromise the victim's backups, succeeding in 57% of those attempts. A backup that the attacker can reach and encrypt does not support any promise of recovery.
Layered protection: what you can do in your own environment
The first layer is endpoint protection with EDR (Endpoint Detection and Response), technology that observes behavior instead of merely comparing files against a list of known threats. A traditional antivirus may fail to recognize a never-before-seen binary, while a detection and response solution notices the pattern of mass encryption, the shutdown of backup services, and privilege escalation, isolating the machine automatically before the movement spreads. Combined with multi-factor authentication on all administrative and remote access, this layer closes the two cheapest paths for an attacker.
The second layer is backup that is isolated, encrypted, and regularly tested. Isolated means the recovery copy cannot be reached with production environment credentials, whether through immutability or true logical separation. Tested means someone actually performed a restore, timed the process, and documented the result, because a backup that is never restored remains an assumption recorded in a report. Well-designed structures for backup and disaster recovery turn weeks of shutdown into hours of controlled downtime.
The third layer combines continuous patch management with continuous proactive monitoring. An up-to-date asset inventory, a predictable patching cycle prioritized by real criticality, and intelligent alerts about anomalous behavior form the nervous system of the operation. It is this combination, supported by managed cybersecurityservices, that shortens the distance between the first sign of compromise and the response, and that distance determines the size of the loss.
Questions every decision-maker should be asking right now
Before any budget or technology decision, it is worth confronting three questions with evidence-based answers, not impressions:
- Would my backups really work in a disaster like this one? How long would it take for my operation to come back online?
- Does my team have the right tools to identify and block an attack like this immediately, before it causes the full disaster? How am I investing in preparing my technical team?
- How long would my company survive without access to its systems and files?
Would my backups really work in a disaster like this one? How long would it take for my operation to come back online?
The honest answer depends on concrete evidence: the record of the last full restoration test. In Baltimore's case, what is publicly known is that rebuilding the systems stretched on for months, in successive stages. Copies that exist but have never been restored in a real environment do not support any promise of recovery.
Clearly define the RTO (Recovery Time Objective, the maximum acceptable time until a system is back online) and the RPO (Recovery Point Objective, the maximum acceptable volume of data loss) for each critical system, and compare those numbers with the time the last restoration actually took. A backup that is isolated, immutable, tested on a defined cycle and backed by a formal report is what turns an expectation into verified capability.
Does my team have the right tools to block an attack like this immediately?
Tools and preparation go hand in hand, and neither delivers results on its own. Endpoint detection and response with automatic containment, continuous proactive monitoring and disciplined patch management shrink the window in which an intruder operates unnoticed, but someone has to receive the alert, interpret it and have the authority to isolate an entire segment when necessary.
Assess whether your technical team has the time, expertise and backing for that decision, or whether it is fully occupied keeping day-to-day operations running. Investing in preparation means periodic simulation exercises, technical upskilling tracks and specialized backup support that complements the internal team at the moments when the decision has to be fast and technically correct.
How long would my company survive without access to its systems and files?
This is the question that translates security into the language of business. Calculate the cost of one hour of downtime by adding up idle payroll, unbilled revenue, contractual penalties and the service that never gets delivered, then multiply it by the number of weeks observed in the Baltimore case. Add to that the reputational effect, hard to measure and slow to recover, on clients who depend on deadlines.
When the result of that calculation appears alongside the annual investment in layered protection, a documented response plan and tested recovery, the budget conversation changes in nature and becomes a conversation about business continuity.
If your company does not yet have an integrated layered protection strategy, consider scheduling a Strategic IT Assessment, with no obligation, to identify vulnerabilities before they become headlines.
Frequently asked questions
What is an isolated backup and why does it matter against ransomware?
An isolated backup is a recovery copy that cannot be accessed, altered or deleted with production environment credentials, whether through immutability or through real logical separation. It matters because ransomware groups actively hunt for backup repositories before encrypting data. Sophos's State of Ransomware report recorded attempts to compromise backups in 94% of attacks, succeeding in 57% of cases.
Does paying the ransom resolve a ransomware attack?
Paying does not guarantee that data will be returned or that operations will resume quickly, because decryption depends on tools supplied by the criminals themselves, which are often slow and incomplete. The city of Baltimore publicly decided not to pay the roughly US$ 76 thousand demanded in 2019, and still recorded US$ 18.2 million in recovery costs and lost revenue. The ability to restore from intact copies is what defines the real time to recovery.
What is the difference between traditional antivirus and EDR?
Traditional antivirus compares files against a list of already known threats and tends to fail against never-before-seen variants. EDR (Endpoint Detection and Response) analyzes behavior, identifying patterns such as mass file encryption, shutdown of backup services and privilege escalation. When it detects that pattern, it isolates the machine automatically, limiting spread within the network.