Secure & Simple — Podcast for Consultants and vCISOs on Cybersecurity Governance and Compliance Responding to Ransomware Attack [Case Study] | Interview with Yannick Hirt
Feb 24, 2026
Yannick Hirt, founder and CEO of Odysseus and incident-response specialist, recounts a real ransomware attack on an international industrial firm. He describes phishing of a privileged account, standing up a war room, mapping critical apps, and choosing restore-from-verified-cloud-backups. They cover negotiating via intermediaries, recovery timelines, insurer coordination, forensics tradeoffs, and the value of realistic war-room training.
AI Snips
Chapters
Transcript
Episode notes
Privileged Admin Phishing Led To Overnight Encryption
- An IT admin likely opened a phishing attachment and the attacker used that privileged access to move laterally and encrypt servers overnight.
- Yannick Hirt described the attack as an overnight encryption discovered the next morning with ransom notes on systems.
Organize Recovery In Parallel Streams
- Run the incident response as parallel recovery streams (infrastructure, endpoints, apps, communications, threat intel) to separate responsibilities and accelerate work.
- Yannick organized the response as a small program with dedicated stream leads and SLAs.
Test Backups And Restore To A Clean Environment
- Validate and test backups frequently so you can restore without paying ransom; Yannick's client restored critical systems from cloud backups two months after migration.
- They verified backups during negotiations and rebuilt into a fresh infrastructure.