In February 2024 a ransomware attack forced the agency that administers government pensions to shut down every system it had. Staff processed retirements, resignations and death benefits by hand, and payments ran late. The rebuilt systems came back online on 21 June 2024, about four months later.
Ransomware is an attack that locks a company’s files and demands payment to release them. Most planning goes into keeping it out. This post is about the other half of the problem: how long your business could keep working once the systems are down, and what you would work with in the meantime.
What recovery takes in South Africa
Sophos surveys ransomware victims every year. Its 2026 figures for South Africa, as reported in the local press:
- 40% of organisations recovered within a week. That was the lowest rate of any country surveyed, against 55% worldwide.
- 13% took between one and six months.
- R17 million was the average cost of recovery, before any ransom.
- 54% of those whose data was locked restored it from backups, up from 35% the year before.
So the likely outcome of an attack is more than a week without normal systems. A plan that assumes two days is planning for the best case.
Why recovery takes weeks
- Machines are rebuilt, because cleaning them is unreliable. A computer an attacker controlled cannot be trusted again, so each one is wiped and set up from nothing.
- The way in must be found first. Restoring everything before the entry point is closed invites the same attack twice.
- Backups have to be checked. Attackers often sit inside a network for weeks, so recent backups may carry their tools, or may be locked along with everything else.
- Systems depend on each other. Invoicing cannot return before the customer database does. The order matters, and working it out during the crisis costs days.
Work out your own number
List the handful of activities the business cannot stop: taking orders, paying staff, paying suppliers, answering clients. For each one, answer three questions.
- Which systems does it need? Include the ones a supplier runs for you.
- How long can it stop before real harm starts? Harm means missed salaries, breached contracts, or clients who leave. For payroll the answer may be the days left until month-end.
- How would you do it by hand? If nobody can say, that activity stops when the system does.
The shortest answer to question two is your number. It tells you how fast recovery has to be, and which system comes back first.
What a paper fallback needs
- Contact lists kept outside the systems. Staff, key clients and suppliers, printed or stored somewhere separate. An address book inside a locked email system helps nobody.
- A way to record work. Simple forms for orders and payments, so that everything can be entered once the systems return.
- A way to pay people. Know how you would run salaries through the bank directly, using last month’s figures if you have to.
- A second way to talk. Phone numbers and a messaging group that do not depend on company email.
- One named decision-maker. Someone who can declare the fallback in force without calling a meeting.
Shorten the gap
- Keep one backup copy where an attacker holding your passwords cannot change or delete it.
- Restore from backup as a test, and time it. That measured time is the only recovery estimate worth trusting.
- Agree the order in which systems come back, and write it down.
- Rehearse the paper fallback for one morning a year. The gaps show up within the first hour.
How many days could your business run on paper? Tell us what’s on fire