Accounting office locked out during filing season
Ransomware encrypts a small accounting office's file server overnight. A typical response: contain the spread, rebuild the server, and restore from clean off-site backups without paying the ransom.
Typical goal: back to work in days, not weeks