IslandPitch.in
The Backup That Wasn't
Ransomware locks a clinic's files — and the backup The Mundane promised turns out to be empty.
Prepare for the Flood — in the tradition of the Ant & the Grasshopper and the wise and foolish builders
A busy morning at the free clinic. Waiting room full, charts open, coffee hot.
Forty patients today. Let's get everyone seen.
Then every screen flickered red at once. Chaos had been inside for days.
Your files are mine now — every chart, every record, locked. Pay, or the clinic goes dark.
Priya didn't panic. She had a backup. The Mundane had set it up years ago.
It's fine — we restore from backup. We DO have a backup… right?
Ohhh. It's been 'running' since 2021. Green checkmark and everything. Nobody ever opened it. It's… empty.
The green checkmark had been lying for three years. The waiting room kept filling.
Three years of charts. Patients in the lobby right now. What do we DO?
First — breathe. You're not the first clinic Chaos hit this week. But you're about to be the one that gets back up.
Across town, a clinic IP Bot had set up shrugged off the very same attack — the house built on rock, while Priya's sat on sand.
While the grasshopper fiddled, the ant stored grain for winter. Three-two-one: three copies, two kinds of storage, one off-site and offline where Chaos can't reach. And we test the restore every quarter.
A backup you've never restored is just a hope with a green checkmark. We restore for real. #AutomateThis!
IP Bot stood up a fresh, tested system for Priya while Masked Crewsader rallied the floor.
Paper charts for the urgent cases. Phone tree to the team. Know your two numbers — how long you can be down (RTO), how much you can lose (RPO) — and build to meet them.
By afternoon, a clean system came online from the off-site copy. Chaos's lock opened on nothing.
But — you were supposed to PAY me! Your backup was empty!
That one was. The new one isn't. And we test it now.
Priya's clinic adopted 3-2-1 that week, with a calendar reminder to test every quarter. The next 'Tuesday' was just a Tuesday.
The day Chaos strikes is the wrong day to learn your backup was a guess.
The lesson
An untested backup is a guess. Follow 3-2-1 (with one copy off-site and offline), test your restores quarterly, and know your RTO and RPO before the bad day arrives.
Ready to reach your Pitch?
You don't need a full-time CTO to do this right. Island Pitch works as your Fractional CTO — senior technology leadership at a nonprofit's budget, helping you choose well, lock the doors, and sleep at night.
Get the whole field manual
Every concept in this story — and six more chapters — in one printable PDF.
The field manual is yours — grab it now.
Our signup form is being upgraded. In the meantime, here's the full PDF — no form to fill out.
Download the field manual (PDF)Want occasional tech tips by email too? Talk to a Fractional CTO above — we'll get you on the list.