Ransomware in Nebraska still starts the boring way: a phished mailbox, an RDP box that should never have been on the internet, or an unpatched VPN. This playbook is generic. It is not a story about a named client, and it is not legal advice.
What “we might have ransomware” looks like
- Files with strange extensions, or a note demanding Bitcoin.
- Shared drives suddenly unreadable.
- EDR/SOC telling you a host is encrypting.
- Backup jobs failing at the same time as odd admin logins.
First hours
- Don’t negotiate with the pop-up. Payment decisions belong to leadership + counsel + carrier — after you know what you still have in backup.
- Isolate. Network first. Mass “shutdown every PC” can destroy volatile evidence and doesn’t stop a cloud mailbox that’s already forwarding.
- Assume identity is involved. Resetting one local admin password is not containment. See email security if mail was the door.
- Protect backups. If the backup console is on the same domain the attacker has, treat it as hostile until proven otherwise. Tested restores live on backup & DR.
- Call. Huntress SOC investigates endpoints 24/7 on SAINT-managed environments; SAINT coordinates with you. 531-625-2111.
Lincoln and Omaha context
We are a Hickman-based service-area business. Lincoln is a primary market; Omaha-metro is a core coverage area. We do not claim a storefront. On-site help for a Lincoln office is a different logistics problem than a multi-site Omaha manufacturer — the playbook steps above don’t change.
After the fire: a cybersecurity assessment so the next phish isn’t a sequel. Insurance questionnaire: insurability check.
