Ransomware Case Study from Orange Hat Tech Summit

This clip is from the Orange Hat Tech Summit cybersecurity panel, recorded at Orange Hat Brewery in

Knoxville. Solomon IT hosted Brian Doty of Kaseya, Nick Christian of the Tennessee Bureau of

Investigation, and Jennifer Ross of WatchGuard. The short video is the opening case study: what

changes when one organization funds backup and another puts it off.

The story is told by Brian Doty, as noted in the video description. A partner in Alabama recommended a

business continuity plan and backup to the city of Florence, next to Muscle Shoals. The city said the

funding was not there and declined. A packaging company across the river received the same

recommendation and put the plan in place. About six months later, both organizations were hit by the

same group. The packaging company was back in operation within two hours. Florence was down for

six weeks, spent on the order of four hundred thousand dollars trying to recover, and still did not get all

of its data back. The speaker also noted the exposure of personally identifiable information.

Owners and public-sector managers should watch this before treating backup as a later budget item.

The clip does not walk through tools or a response playbook. It makes one comparison. The

organization that accepted the backup recommendation returned to work the same morning. The

organization that deferred the work spent weeks and a large recovery bill, and still lost data. Nick

Christian and Jennifer Ross are introduced on the panel. This three-minute cut stays with the

ransomware story.

If your backups have not been tested, or if continuity is still waiting on the next budget cycle, start with a

free IT assessment. Solomon IT will review how you would restore, what is covered, and which daily

work a week of downtime would stop. The figures in this clip are the speaker's account of that incident.

They are not a Solomon IT measurement of your environment.

Key Takeaways

• Delaying backup because funding is tight leaves no clean restore path when ransomware hits.

• The same threat group hit both organizations. Preparedness, not a different attacker, was the

  difference in downtime.

• A business continuity plan that was already in place returned the packaging company to

  operation in about two hours.

• The city that declined backup was down for six weeks and still did not recover all of its data, as

  reported in the clip.

• Recovery spending, described as roughly four hundred thousand dollars, did not replace the

  data that was lost.

• Personally identifiable information was part of the exposure. Downtime is not the only cost.