incident post-mortem

The alert came in at 2:47 AM. File shares encrypted. Domain controllers unreachable. The backup server — also encrypted. The client’s IT lead called it a total loss. Twenty minutes…