When the backup is on the same domain

The 3-2-1 principle means at least three copies, on two different media, with one copy offsite. PayFlow may have had three copies in theory, but the copies were not independent. The backup server was domain-joined, online and used the same privileged account as the virtualization administrators. Once the attacker had domain administrator rights, the backup files were inside the blast radius. They were neither isolated nor immutable.

So 'we have backups' failed on four points:

• Isolation: the backup server was on the same domain and used the same credentials.
• Immutability: the files could be encrypted or deleted by the compromised account.
• Offline copy: there was no air-gapped or offline copy the attacker could not reach.
• Tested restore: the 8-hour RTO was never validated; actual restoration took three days.

The fix is not simply 'more backups'. Use immutable object storage with separate credentials and MFA, a separate backup domain or workgroup, network segmentation, offline retention, and quarterly restore tests against the RTO. Test restoration of a payroll run, not just a file. The cost is justified by the downtime and contractual penalties already incurred.

RTO is the maximum tolerable time to restore the service after disruption. PayFlow promised 8 hours; actual restoration took 72 hours. RPO is the maximum tolerable data loss measured in time. PayFlow promised 24 hours; 1,200 employee records from the last payroll run were lost and must be reconstructed manually.

Consequences

• Contractual SLA breach, service credits and possible termination rights.
• Payroll errors and late salaries for employees of 400 clients.
• Regulatory exposure if personal data was lost or accessed; a personal data breach may require notification within 72 hours where GDPR applies.
• Reputational damage and client churn in a trust-sensitive payroll business.
• Insurance scrutiny and a €100,000 deductible, plus possibly higher premiums.

Communication to clients State known facts: what happened, which data and payroll periods are affected, the workaround, the expected restoration time and a single contact. Do not speculate or promise normal service before validation. Give clients the information they need to communicate with their employees and to meet their own legal duties. If personal data was breached, coordinate notification with legal advice and contractual roles.

First 10 days

1. Contain: isolate affected hosts, disable compromised accounts, revoke sessions, and block command-and-control traffic.
2. Preserve evidence and engage the insurer's incident response panel and forensics before rebuilding.
3. Scope: identify the initial access, persistence, data access and whether client data was exfiltrated.
4. Notify: legal, board, insurer, regulators if required and clients under contract. Do not delay notification to protect reputation.
5. Eradicate: remove attacker access, rebuild from known-good images, rotate credentials and separate backup credentials.
6. Restore in priority order: payroll calculation, client access, reporting. Validate integrity before switching over.
7. Communicate: regular factual updates to clients and staff with a single owner.
8. Review: after-action report with control fixes, restore tests and board risk acceptance.

Two board decisions

• Whether to pay the ransom. The board must weigh legal, sanctions and ethical advice, the lack of guarantee, and the risk of funding crime. Payment should not be treated as a recovery plan.
• Whether to notify and temporarily suspend payroll processing. This affects clients and employees, so it is a business-continuity and risk-appetite decision, not an IT decision alone.

The priority is safe restoration and honest communication, not a quick payment.