Ransomware recovery for a five-division manufacturing business, in 72 hours.
A 300-person chemical manufacturing business with five divisions across Tamil Nadu. No ransom paid. No repeat incidents since.
Client overview
Chemical Manufacturing
A 300-person chemical manufacturing business with five divisions across Tamil Nadu.
Technologies used
The problem
A single server failure turned out to be the entire business.
Within hours, staff across all five divisions could not access files, applications, or any business system. The team initially thought one server had failed. Every server across every division had in fact been encrypted overnight, along with the laptops of finance and management staff.
There was no firewall at any location, no multi-factor authentication, and antivirus software that had been disabled by the attacker using standard Windows tools. The attacker had been inside the network for roughly 14 hours before the ransomware ran.
The only surviving restore point was a backup taken months earlier by a third-party software vendor during a routine upgrade.
The solution
A complete rebuild, from exposed to layered.
Uniware's team followed the NIST Cybersecurity Framework end to end, giving the recovery a documented, auditable structure. Several stages ran in parallel, not one after another.
- 1IdentifyEndpoint detection and response (EDR) was deployed across every reachable system. Within a few hours, that gave the team a complete list of the business's devices and showed which had been hit and which were clean.
- 2ProtectFirewalls with intrusion prevention were installed at every location. A secure VPN with MFA replaced exposed remote desktop access. Active Directory was rebuilt from scratch with hardened policies.
- 3DetectTamper-proof activity logging and automated alerts configured for suspicious behaviour going forward.
- 4RespondMachines that had been hit were taken off the network. Clean machines were moved into an isolated environment with no internet access. Compromised accounts were disabled, passwords were reset business-wide, and forensic evidence was preserved on the original drives.
- 5RecoverTwo teams worked in parallel: one rebuilt the servers on clean hardware, the other reinstalled and protected every affected laptop. Data was restored as far as the last backup allowed, and the client's team re-entered the rest by hand. By Monday, users were back at work.
Technologies used
Before and after
Read row by row, what actually changed.
| Metric | Before | After |
|---|---|---|
| Firewall | None at any location | Firewall with intrusion prevention at every location |
| Remote access | Exposed, no MFA | Secure VPN with MFA |
| Endpoint protection | Basic antivirus, disabled by attacker | EDR on all servers and workstations |
| Backups | On the same server, plus a connected USB drive | Dedicated backup software + rotational offline drives |
| User accounts | Weak passwords, no MFA, no lockout | Strong passwords, MFA, lockout policies |
| Asset discovery | None | Full device inventory |
| Incident response plan | None in place | Documented playbook delivered |
The results
What changed, in practice.
- Zero recurrence of security incidents since the recovery and remediation
- Every IT asset found and classified, giving clear visibility of what needs protecting
- Documented, repeatable incident response playbook, so the team can respond quickly next time
- Layered backup and recovery with offline copies, so business continuity no longer rests on one copy
A quote from our team
If a client calls on a Saturday, it is almost always an attack. We went immediately. We rebuilt their servers while their team re-entered the missing data by hand. By Monday, they were back at work.
Dhanasekar
Chief Technology Officer, Uniware Systems
Facing something similar?
Talk to the Uniware team about ransomware recovery and prevention, before an attack forces the conversation.
Book a Security Review