Anatomy of a Ransomware Incident

This case study follows a ransomware outbreak from the first phishing email to full production recovery, drawing out the decisions that mattered most under pressure.

The lesson is not a new tool — it is that the difference between a contained incident and a plant-wide outage often comes down to whether operators felt able to raise the alarm early.