Ransomware case studies from schools, councils, a hospital, manufacturers and finance teams that prepared for an attack, contained it and stayed in control.
Every organisation in these stories had security in place, and ransomware still found a way in, through a remote login, an expected email attachment or a trusted file. What changed the outcome was containment in seconds, a clear record of what was affected and a safe path to ransomware recovery. Find a story from a sector like yours.
Schools run on small IT teams and open networks, which makes a ransomware attack on schools hard to see coming. These schools and districts contain it before it spreads, so lessons carry on.
Torrance Unified School District
United States. A malicious attachment was contained within a month of going live, with no data lost and no files encrypted.
Sir Roger Manwood’s School
United Kingdom. After an attack that took two weeks to recover from, the school has contained four further attempts.
St Bede’s School
United Kingdom. A secondary school of 1,800 students isolates an affected device automatically, so learning carries on.
Winchester College
United Kingdom. A boarding school with 1,000 users keeps watch around the clock, even when the IT team is off site.
Councils and hospitals hold data that people rely on every day. These organisations added containment so their services keep running when an attack gets past the first defences.
Newport City Council
Wales. With SRS Wales and partner Ricoh, the council protects the shared data behind services for 150,000 residents.
A European hospital
Europe. After a recovery that took three and a half months, the hospital added containment to its rebuilt network.
For manufacturers and financial firms, every hour of downtime has a price. These organisations contain ransomware in seconds and get back to work fast.
Star Pipe Products
United States. After an earlier attack took three months to recover from, the manufacturer now contains ransomware before it disrupts operations.
Ricoh
United States. Ricoh contains ransomware inside its own infrastructure and offers the same protection to its customers.
A European finance company
Europe. Three infected users were isolated within seconds, and data and endpoints were restored within 24 hours.
Every story here began with a team that wanted to stay in control when ransomware got in. See what Helm means for your industry, or talk to us about what the first minutes of an attack would look like in your environment.
