Twenty-six a month
It happened — June 2026City of London Police via Infosecurity Magazine, Jun 2026
City of London Police: 323 ransomware victims reported in twelve months — 26 a month — over half of them small and mid-sized firms, with average losses around £270,000. Their advice, and ours: don't pay, report, prepare.
Your version starts before nine, when the first person in can't open anything and a text file on the desktop explains why. There are twenty of you, a server, and backups that “exist” — on a network drive that sat on the same network with the same admin password, so it's encrypted too. The note asks for less than the £270,000 average, because the people who wrote it read the same statistics we do.
This is you if Backups have never actually been restored, only believed in; remote access has no MFA, or one shared admin password; you'd have to guess what an attacker could reach from one PC.
How we run it
The first two hours are isolation and scope.
Affected machines come off the network but stay powered on — switching them off feels safer, and it destroys evidence along with any chance of recovering keys from memory. Then we establish what's hit, what survived, and whether data left the building.
One instruction holds through everything.
Nobody pays, nobody negotiates, nobody emails the attackers. That's the police line and it's ours — and the incident is reported to Action Fraud the same morning, which the police explicitly ask for.
Then the rebuild, from the cleanest point that survived.
Fresh systems, data — never programs — restored from whatever backup held, every credential in the company rotated, and the way in found and closed. Extra engineers from our network scale to the machine count.
And when it's over, the honest conversation.
What would have made this a bad Tuesday instead of a bad month: restores tested quarterly, one backup copy that lives offline, monitoring that notices a thousand files changing at once. That plan gets quoted in writing — and it costs a fraction of the ransom nobody paid.
Made boring by: Complete — where tested backups, monitoring and patching live. A year of it for twenty people costs a fraction of one average incident. Response at £85/h · Complete £99/user/month
Real figures: City of London Police, Jun 2026. The twenty-person firm is illustrative.