Analysis of a recent attack: what we can learn (case study)

In July 2021, a ransomware attack brought more than 200 U.S. companies to a standstill within hours. Through a single software provider — Kaseya — cybercriminals managed to impact hundreds of organizations at once, from small local businesses to large international groups.

We hear about these kinds of incidents regularly. And yet, every time, the same questions come up: how did it happen? Could it have been prevented? And most importantly — could it happen to us?

At CreativMinds, we support organizations of all sizes on these issues. And what we see is that the most devastating attacks don’t necessarily target the least protected companies. They target those that believed they were protected enough.

So rather than staying at a high level, I wanted to walk through a concrete case — fictional in its details, but based on very real mechanisms — to break down what actually happens when an attack succeeds. Not to scare you. To understand.

The context: a “well-equipped” company

Let’s call it NeoTech — a fintech company with around a hundred employees, and significant investments in cybersecurity: firewalls, antivirus, backups, employee training. On paper, everything was in place.

Yet in March 2023, a ransomware attack brought all of their operations to a halt. Customer data — several million users — was compromised. Business activity stopped overnight.

What matters here isn’t pointing out what wasn’t done. It’s understanding why, despite the resources, it wasn’t enough. Because that’s often where the real difference lies between a company that withstands an attack and one that doesn’t.

How it started

The attack didn’t start with a spectacular technical exploit. It started with an email.

A targeted message — what we call spear phishing — sent to a few key employees. The email appeared to come from a colleague. It contained a link to a shared document, seemingly harmless.

One click. That’s all it took.

That click triggered the download of a small program — a backdoor — which installed itself silently. From that point on, the attackers had a foothold inside the network.

What we often forget is that this kind of attack doesn’t rely on people being careless. It relies on their day-to-day reality. When you’re dealing with 80 emails a day, back-to-back meetings, trying to respond quickly — vigilance drops. That’s human.

Silent escalation

Once inside, the attackers didn’t act immediately. They started by exploring — understanding how the network was structured, identifying accounts with elevated privileges.

Then came what’s known as privilege escalation: gaining administrative access, the kind that opens every door. From there, they moved laterally — from server to server, system to system — until they reached the critical databases.

What stands out in this type of attack is the timeline. Between the initial compromise and the ransomware deployment, several weeks can pass. The attackers are there, in the background, gathering data, preparing the ground.

And no one notices.

The tipping point

On D-day, the ransomware was deployed. Within a few hours, all critical systems were encrypted. No access to business applications, no access to customer data — nothing.

A ransom demand appeared on the screens: pay to recover the data, or lose everything.

I won’t dwell on whether to pay or not — it’s a complex debate, and every situation is different. What matters here is what made this outcome possible.

What really went wrong

When you analyze this type of incident after the fact, there’s rarely a single root cause. It’s usually an accumulation of small gaps, postponed decisions, and misaligned priorities.

In this specific case, several factors played a role:

• An unpatched vulnerability. A known flaw in a network management software. The patch had been available for months — but hadn’t been applied. This kind of delay is common: IT teams are often overwhelmed, and updates get pushed behind day-to-day urgencies. Except this time, it became the entry point.
• Insufficient network segmentation. Once inside, the attackers were able to move relatively freely. With better segmentation, the spread could have been contained.
• Outdated security policies. Procedures hadn’t been reviewed in years. They didn’t account for new types of threats or changes in the infrastructure.
• Faded awareness. Phishing training had taken place — but a long time ago. Without regular reminders, reflexes weaken.

None of these issues alone would have been enough to cause a disaster. But combined, they created the perfect conditions.

What worked well in the response

It would be unfair to focus only on what failed. Because in crisis management, some things were handled well.

The security team reacted quickly. As soon as the first alerts came in, compromised segments were isolated. This limited the spread and protected part of the data.

Backups — those that hadn’t been affected — made it possible to progressively restore the systems. Without them, the situation would have been far worse.

Communication was transparent. Clients and partners were informed quickly, which helped limit the long-term reputational impact. That’s not always the case — many companies choose to downplay or delay communication, which often ends up backfiring.

Key takeaways

I’m not a fan of overly polished “best practices” lists — they give the impression that cybersecurity is just a box-ticking exercise. It’s not. It’s an ongoing balance, constant attention, a culture that needs to be built over time.

That said, there are still concrete lessons to take away from this kind of incident.

On patch management: it’s probably the least rewarding part of cybersecurity. No one likes doing updates. They take time, can create compatibility issues, and require coordination. And yet, a large share of attacks exploit known vulnerabilities with available fixes. Automating this process as much as possible is well worth the investment.

On network segmentation: isolating environments and limiting access to what’s strictly necessary is what makes the difference between a contained breach and a full-scale disaster. It’s upfront work — but it’s what limits the damage when (not if) something gets through.

On detection: having tools that monitor abnormal behavior in real time is what allows you to spot an intrusion before it causes harm. EDR and XDR solutions have come a long way in recent years — they’re no longer reserved for large enterprises.

On awareness: one-off training isn’t enough. Vigilance needs to be maintained. Regular simulations, contextual reminders, shared feedback — that’s what builds lasting reflexes.

On incident response plans: having a documented, tested emergency plan with clearly defined roles is what prevents improvisation in the middle of chaos. And improvisation, in a cyber crisis, is costly.

A matter of mindset more than tools

What strikes me, after years of supporting companies on these topics, is that the difference doesn’t really come down to tools. Most organizations have access to the same technologies.

The difference lies in mindset.

Is cybersecurity seen as a technical constraint delegated to IT? Or as a strategic issue that concerns the entire organization?

Do you assume you’re “secure enough”? Or do you start from the premise that an attack will eventually happen — and prepare accordingly?

Are employees viewed as the weakest link? Or as the first line of defense?

These questions can’t be solved with software. They require vision, culture, and leadership commitment.

In conclusion

This attack on NeoTech is nothing extraordinary. It resembles dozens of others we’ve analyzed or supported in the aftermath.

What makes it interesting is precisely how ordinary it is. Because it shows that the patterns are often the same: a human entry point, exploitation of known vulnerabilities, lateral spread enabled by poor segmentation, detection that comes too late.

It also shows that the levers for protection are accessible. Not free, not simple — but accessible.

At CreativMinds, we believe cybersecurity isn’t something you hand off to specialists once a year. It’s a collective capability, built day by day, across every level of the organization.

If this article has made you reflect on your own situation, that’s already a first step. The next is turning that reflection into action — even small, incremental steps.

Because in cybersecurity, what matters isn’t being perfect. It’s being prepared.