01 The Problem
A 4-person video production company in Culver City clicked a phishing email attachment on a Monday morning. By the time they noticed the ransom note, 3TB of project files — including deliverables due that Friday — were encrypted with AES-256. The attacker demanded $4,800 in Bitcoin.
02 Our Approach
We immediately isolated the infected machine from the network to stop propagation, then ran forensic analysis to identify the ransomware variant (LockBit 2.0). Using shadow volume copies and specialized decryption tools, we recovered 98% of their files. The remaining 2% were reconstructed from a backup NAS that had partially synced before the attack. We also hardened their network with proper firewall rules and trained the team on phishing recognition.
03 The Result
All Friday deliverables were recovered intact. The client avoided paying the ransom. We installed a real-time backup solution and endpoint protection that now runs silently in the background — total cost was less than half the ransom demand.