The IT Experts Podcast

The first-hand narrative contains genuinely useful operational detail - how the attack propagated from a non-compliant acquired client, the stripe-backup failure mode, the Friday-night banking trap for crypto transfers, and the hackers' timing around financial year-end. However, the 'lessons' segment retreats into well-worn MSP security platitudes and the episode has significant filler and host throat-clearing.

“they had started to move away from using TIP backup to Microsoft Blob and were in the middle of that transition, but failed to verify that the backups were actually working. So not only was the primary backup not complete, also the secondary backup which was off site”

“they unveiled it or launched it I say in mid September. So we had gone through the whole situation and found that what had happened was due to human error”

The 'it's not if but when' framing is repeated verbatim multiple times and the three closing lessons (baseline client security, verify backups, eat your own dog food) are well-circulated MSP advice. The genuinely fresh angle is the hacker-reputation-maintenance observation and the hackers tracking acquisition announcements to size the target, but these are anecdotal rather than developed as contrarian frameworks.

“when they did provide the key on the Sunday, they also provided us with a week's worth of customer service facility to help with any issues”

“this particular ransomware group...had a reputation to maintain and they didn't want to get a bad reference by not actually fulfilling their commitment”

Ken is a genuine MSP operator with real scale - built from scratch in 2009, grew through six acquisitions to £17M revenue and 120 staff before a trade sale. He is speaking from direct lived experience of the specific event described, not as a vendor or thought-leader, which gives him high credibility for the MSP audience.

“in 2009 I started an MSP from scratch, bought two businesses, put them together, and then over the next number of years acquired four more companies. So we got up to the point whereby in 2023 we were turning over about 17 million of revenue, had 120 staff”

“I've described to many people as the worst period in my life for reasons which will become obvious”

The episode is anchored in concrete numbers throughout: £300k ransom paid, £200k in ancillary costs, 42 affected managed service clients, 85% recurring revenue retained, three weeks to restore, a £5M revenue base in the acquired entity, and a specific timeline from June to mid-September 2021. The backup failure mechanism (mid-migration from TIP to Azure Blob, producing unrestorable stripe backups) is technically specific. Deductions for no named ransomware group and no named client examples.

“we were able to negotiate the price down to 300,000...The other 200,000 came from the costs that we had to incur. To rebuild the systems, the overtime that we had to pay, the compensation that we had to pay out to some customers, the legal fees”

“we retained 85% of the revenue, recurring revenue we had from M, our client base. And what's more, we got them all onto three year contracts based on us moving them to Azure”

The host asks a few substantive follow-ups (how the attackers communicated, whether targeting was deliberate, the size of the business at the time) but frequently defaults to affirmation and echo ('absolutely', 'brilliant', 'that's just mad') rather than pushing on hard edges - for example, the decision to pay the ransom or the absence of cyber insurance on the acquired entity are never meaningfully challenged.

“Do you believe that they targeted you because they knew the size of the business and what was going on with the acquisitions”

“what would be the three absolute non negotiable actions, specific actions that every single MSP should be doing this year”