Cloud Backup & Disaster Recovery Saves Artisan Coffee Roastery from Ransomware

An independent London coffee roastery had built a loyal following over five years, supplying beans to 30 cafés across London and selling directly to consumers online. Their entire business — roast profiles, supplier contacts, customer orders, wholesale agreements, and financial records — lived on a single desktop PC in the roastery office and a laptop that the owner carried between the roastery, the warehouse, and home. There was no backup, no security software, and no IT support. The owner, a master roaster who had spent 15 years perfecting his craft, had never considered that a single ransomware infection could destroy everything he had built.

It nearly did. On a Saturday morning, the owner opened the laptop to check weekend orders and found a ransom note demanding £8,000 in Bitcoin. Six months of customer order data, supplier contacts, and wholesale pricing agreements were encrypted. The desktop PC, connected to the same network, was also infected. The owner called us in a panic — he had a wholesale delivery to 30 cafés on Monday morning and no way to access his order list.

We connected remotely within 30 minutes and began triage. The ransomware was a Conti variant that had spread through the roastery's simple network via an unpatched SMB vulnerability. The laptop and desktop were both encrypted, but we discovered that the owner had emailed the most recent order list to a wholesale customer the previous week — meaning we could reconstruct the Monday delivery from the sent items in his Gmail. The historical data was gone, but the immediate crisis was manageable. The real question was how to prevent this from ever happening again.

The roastery's annual revenue was £420,000, and the owner's IT budget was £200 per month — the cost of a single coffee subscription for a small business. Traditional IT support, with on-site servers, maintenance contracts, and enterprise software, was simply unaffordable. But the owner needed enterprise-grade data protection, backup, and security — because his business was just as dependent on data as any large corporation, and the cost of losing it was just as catastrophic.

We designed a cloud-first solution that delivered enterprise-grade protection within the roastery's budget. The core was Microsoft 365 Business Basic at £4.50 per user per month — for 8 users, that was £36 per month. This included Exchange Online email (replacing the owner's personal Gmail), OneDrive for Business with 1 TB of storage per user, SharePoint Online for shared files, and Microsoft Teams for communication. Every file stored in OneDrive and SharePoint had automatic versioning and a 30-day recycle bin, meaning accidental deletions or ransomware encryption could be rolled back without a separate backup system.

For backup, we added Azure Backup at approximately £40 per month, providing daily automated backups of all Microsoft 365 data with 90-day retention and immutable storage. This meant that even if ransomware encrypted the Microsoft 365 data, the backups could not be deleted or modified — the roastery would always be able to recover. For security, we deployed Microsoft Defender for Endpoint (included in Business Basic) and multi-factor authentication at no additional cost. The total monthly cost was £180 — within the roastery's budget.

We began implementation on the Saturday of the ransomware attack. First, we isolated both infected devices from the network and began the recovery process. The laptop was wiped and reinstalled with a clean Windows image, and the desktop PC was similarly rebuilt. While the devices were being rebuilt, we set up the Microsoft 365 tenant, configured the roastery's custom email domain, and created 8 user accounts.

On Sunday, we migrated the owner's Gmail to Exchange Online using Microsoft's built-in migration tool. All historical email was moved to the new Exchange Online mailbox, and the owner's email address remained the same — customers and suppliers noticed no change. We configured email on all 8 devices using Outlook and the mobile Outlook app, and set up Microsoft Authenticator for MFA on every account.

On Monday, we migrated all surviving business files to SharePoint Online. We designed a simple SharePoint structure: a 'Roast Profiles' document library for the owner's coffee recipes, a 'Wholesale' library for customer orders and pricing, a 'Suppliers' library for supplier contacts and agreements, and a 'Finance' library for financial records. The owner was initially concerned about moving his carefully guarded roast profiles to the cloud, but we explained that SharePoint's permission model meant only he had access to that library — no one else in the roastery could view or edit the recipes.

By Monday evening — less than 48 hours after the ransomware attack — the roastery was fully operational on the new cloud platform. The Monday wholesale delivery went out on time, reconstructed from the emailed order list. The owner accessed his roast profiles, supplier contacts, and customer orders from his freshly rebuilt laptop, with every file backed up automatically and protected by multi-factor authentication.

With the immediate crisis resolved, we focused on building long-term resilience. The roastery had no IT expertise and no dedicated IT staff, so the solution had to be self-sustaining. We configured Azure Backup to run automatically every night at 2 AM, backing up all Exchange email, SharePoint files, and OneDrive documents to immutable storage. The owner received a monthly email report confirming successful backups — a simple, non-technical confirmation that his data was safe.

We deployed Microsoft Defender for Endpoint on all devices, providing real-time anti-malware protection that would automatically detect and quarantine ransomware. We configured automatic Windows updates, ensuring the SMB vulnerability that enabled the original attack was patched on every device. And we set up multi-factor authentication on every account, meaning even if an attacker obtained a password, they couldn't access the roastery's data without the user's phone.

We also replaced the roastery's manual order tracking spreadsheet — which had been lost in the ransomware attack — with a SharePoint List. The list was simple: customer name, product, quantity, delivery date, and status. But it was accessible from any device, backed up automatically, and could not be lost to ransomware. The owner, who had been tracking orders on a spreadsheet for five years, described the SharePoint List as 'the thing I didn't know I needed until I lost everything.'

Finally, we provided a 30-minute training session for the roastery's 8 staff, covering email security (how to spot phishing), file management (how to save to SharePoint instead of local drives), and what to do if they suspected a security issue (call our support line). We left a simple one-page guide pinned to the office wall. The training was basic, but it was enough to transform the roastery's security culture from non-existent to aware.

In the 18 months following the implementation, the roastery experienced zero data loss incidents and zero security incidents. Two phishing emails were caught by Mimecast (added later when the budget allowed) and never reached the owner's inbox. One device was lost — a laptop left on a train — but because it was encrypted with BitLocker and enrolled in Intune, the owner simply logged into the Intune portal, remotely wiped the device, and bought a replacement. No data was compromised, and the roastery was operational on the new laptop within 2 hours.

The roastery's monthly IT cost of £180 was less than the cost of a single wholesale customer's monthly order — a fraction of the £25,000 the owner estimated he had lost in the ransomware attack. The owner described the investment as 'the best money I've ever spent on the business.' He had gone from a position where a single laptop failure could destroy his business to one where every file, every order, and every roast profile was protected, backed up, and accessible from anywhere.

The roastery has since grown from 8 to 14 staff, opened a second location, and doubled its wholesale customer base. The cloud infrastructure scaled seamlessly — new users were added in minutes, new devices enrolled automatically via Intune, and the SharePoint structure expanded to accommodate the second location. The owner, who once described technology as 'a necessary evil,' now describes it as 'the foundation of the business.' The ransomware attack that nearly destroyed the roastery became the catalyst that made it resilient enough to grow.