Ransomware on the Reporter's Laptop with a Court Deadline and Client PII in Filenames
You are a solo reporter with 12 years of work stored on a laptop and an external drive in your office. Your cloud backup subscription lapsed seven months ago and you have not renewed it. On Monday morning a ransom note appears; files are encrypted, including 40 GB of medical-record exhibits from a workers' compensation case and the transcript of a 2019 hearing that a court order requires you to produce by Friday. Two depositions are scheduled that day, one at 9:30 a.m. The most recent backup on the external drive is seven months old. Your IT consultant says some encrypted filenames appear to contain a claimant's Social Security number, and that paying may or may not yield a working key. There is a second drive with the 2019 hearing files, but it is in a storage unit across town.
1. What are your first actions on Monday morning, in priority order?
Read the worked answer
Priority is: stop the damage, protect the day's obligations, then recover.
- Disconnect the machine from the network. Encryption spreads to mapped and network drives; leaving it connected risks the external drive and any cloud share that still exists. Do not power it off if the consultant wants memory preserved, but isolate it.
- Do not pay, yet. The consultant says payment may not work; payment also funds the crime and may trigger obligations you cannot control. Preserve the ransom note and logs.
- Cover the 9:30 deposition. Arrange a loaner writer and laptop, or notify counsel immediately so they can arrange coverage. A no-show is a professional failure; a warned client can usually accommodate.
- Get the storage-unit drive. The 2019 hearing file has a Friday court deadline and may exist off the encrypted machine.
- Call the consultant for a forensic image of the drive before any recovery attempt, so evidence is preserved.
Recovery of client files is important; the live obligations and the containment come first.
2. What notification obligations arise from the encrypted medical records and the Social Security number in filenames?
Read the worked answer
Treat this as a probable confidentiality breach and work through it systematically rather than deciding alone.
Assess scope. Identify which clients' data was on the machine, whether the encryption actually exfiltrated data, and whether a Social Security number in a filename or the medical exhibits are unsecured personal information under your state's breach statute. Medical records from a workers' compensation case are sensitive; a claimant's SSN in a filename is worse, because the filename may have been indexed or synced.
Notify. Tell the affected clients-the carrier, the claimant's counsel, the court if its order is implicated-promptly and in writing. Check your contracts and your state statute for a deadline, which may be as short as 72 hours. Notify your insurer. If the statute requires notice to a state agency or to the individual, ask counsel rather than guessing.
Do not minimize. Telling a client that "nothing was taken" when you cannot know is a misrepresentation that will compound the problem. Say what happened, what was encrypted, what you have preserved, and what you are doing.
Document every notification and its timing.
3. What retention and recovery plan do you put in place after the immediate crisis?
Read the worked answer
Recovery first, then a written plan that answers the questions this incident exposed.
Recovery. Restore from the seven-month-old backup and the storage-unit drive, then reconcile against your job log and billing records to find every job in the gap. Where files are unrecoverable, reconstruct from the court's filed copies, the parties' copies, and paper steno notes-most reporters can rebuild a transcript from notes more reliably than they expect.
Retention. Adopt a written schedule keyed to your jurisdiction's rules: a minimum period for deposition and hearing transcripts, longer for matters on appeal or under a court order, and a litigation hold that suspends deletion when a matter is contested. The 2019 hearing is exactly the file a policy must protect; the encryption only revealed that you had no current copy.
Backup. Reinstate cloud backup immediately and adopt 3-2-1: three copies, two media, one off-site and encrypted at rest. Verify restores quarterly rather than assuming they work.
Security. Full-disk encryption, unique passwords, multifactor authentication, and no SSNs or client names in filenames.