Real incidents. Practical lessons.
What can another business’s
IT experience teach yours?
Reported incidents show why recovery, access, and infrastructure planning matter. The useful question is what your business can check before it needs those arrangements.
About these stories
Learn from the evidence.
These are summaries of publicly reported incidents, not client engagements delivered by Sam’s IT Consulting.
Our recommendations are identified separately from the reported facts. Examples vary in size and location; the lessons can inform small-business decisions without assuming every environment is the same.
Sources reviewed October 17, 2026. These are historical incidents, not current threat alerts. No affiliation or endorsement is implied.
Ransomware · Ontario
A small clinic. Most computers affected.
Toronto dental clinic · Report published October 16, 2019
What happened
In an October 2019 article drawing on CBC reporting, CIRA described a Toronto dental clinic whose files were encrypted across 19 of 22 computers. The article reported a $165,000 ransom demand. That demand is not evidence that a payment was made.
Business impact
The reported encryption affected much of the clinic’s computer environment. The account illustrates how a relatively small number of devices can still represent a significant operational dependency.
Source: CIRA — reporting and commentary, citing CBC ↗
What the account does—and does not—establish
The cited article does not establish the initial entry method, a precise downtime figure, or whether the clinic had usable backups. We do not assume those facts.
Recovery success · Manufacturing
The office was lost. Recovery had another route.
PMBL · United Kingdom · February 2024 · 50 employees, per provider
What happened
CIM Software’s published case study says a February 2024 fire destroyed PMBL’s main office, including servers, local backups, and network equipment. The provider lists the battery manufacturer as having 50 employees.
Business impact
CIM reports that it activated virtual copies of the servers in Datto’s cloud so staff could access applications and data. The account says systems were available the same afternoon and staff could work the following morning. Manufacturing and shipping resumed within days, according to the customer statement.
Source: CIM Software — provider-published customer case study ↗
What the account does—and does not—establish
This is the service provider’s account, including a customer statement—not an independent investigation. Its recovery times describe this engagement and are not a promise for another business.
Service continuity · Data exposure
Keeping services running is only part of recovery.
Tuckers Solicitors · United Kingdom · August 2020
What happened
In its own account of an August 2020 attack, Tuckers Solicitors said its case-management environment remained operational. It reported a two-day loss of email service and an attack on a server holding mainly archived material.
Business impact
Restoring email did not resolve the separate exposure of information. An October update said the stolen material had been published, illustrating that availability and confidentiality can be affected differently.
Source: Tuckers Solicitors — organization’s own incident statement, updated October 2020 ↗
What the account does—and does not—establish
The firm’s statement does not establish a missing network diagram or a particular access-control failure as the cause. This is a professional-services example; we do not present it as a verified 10–50-person business.
Email impersonation · Payment controls
The email looked familiar. The payment went elsewhere.
U.S. company, unnamed by the FBI · Report published August 28, 2015
What happened
An FBI account describes an accountant who received what appeared to be an urgent acquisition request from the company’s travelling CEO. A supposed lawyer then supplied authorization documents. The accountant wired more than US$737,000 before learning that the CEO had sent no such request.
Business impact
The money had been sent on fraudulent instructions. On review, the apparent CEO address used a lookalike domain, and the authorization contained a forged signature. The report does not establish that the CEO’s genuine mailbox was compromised.
Source: FBI — published account of a reported business email compromise case ↗
What the account does—and does not—establish
The FBI does not name the business, verify its employee count, or establish the final recovery outcome in this account. The story predates current Microsoft 365 controls and is used to illustrate an enduring payment-verification risk, not today’s attack rates.
Network resilience · Canada
When the network fails, can you still reach it?
Rogers · July 8–9, 2022 · CRTC-published independent assessment, July 2024
What happened
A CRTC-published assessment by Xona Partners attributed the July 2022 Rogers outage to a router configuration error that triggered excessive routing information. It also identified shortcomings in change review and network recovery arrangements.
Business impact
Wireless and wireline services were disrupted. Staff’s remote management access and communications relied on the affected network, making recovery harder. The assessment identified missing alternative connectivity at critical sites as a contributor to recovery delays.
Source: CRTC — executive summary of Xona Partners’ independent assessment ↗
What the account does—and does not—establish
Rogers is a national telecommunications provider, not a small business. The report’s technical recommendations address carrier networks. We draw proportionate lessons for smaller environments rather than suggesting they need the same architecture or that a second ISP guarantees continuity.
Turn the lesson into a plan
Understand your own dependencies.
A scoped assessment can help identify gaps, explain their business impact, and prioritize practical improvements.
Restore tests and implementation are separately agreed. An assessment does not guarantee prevention or a particular recovery time.
Request a free introductory call