Ransomware Readiness for Accounting Firms: The Latest Backup, Recovery & Response Playbook

Ransomware is one of the most damaging cyberattacks a CPA firm can face. It can lock staff out of client files, halt service delivery and expose confidential information, and it often starts with something as simple as a phishing email or a reused password. In this session, the leader of a digital and risk advisory practice at an accounting firm shares what his team has learned from investigating real ransomware incidents. The focus is on prevention, and also on being ready to respond, because for most firms the question is not if an incident will happen, but when.

The session opens with the most common ways attackers get in: phishing that imitates trusted tools like DocuSign and Microsoft 365, stolen or reused credentials, and accounts with more access than they need. It then walks through a 2026 investigation at a CPA firm. Attackers targeted a newly hired junior employee who had posted about his new job, used his account to phish senior staff, and tried to send electronic fund transfers from a partner’s email while hiding the evidence with inbox rules. The transfer was stopped by other controls. The lessons are practical ones: enforce multi-factor authentication on every business account, harden email security, act on unusual-activity alerts, and restrict sign-ins by location.

Much of the session focuses on backup and restoration, the controls that decide how quickly a firm can recover. The speaker explains why untested backups, assumptions about what cloud providers back up, and IT accounts with too much access are common weak points. He covers the 3-2-1 backup approach, immutable backups and retention periods, and how to agree recovery objectives that balance business needs against cost. He also gives a simple framework for planning, running, validating and reporting on restoration tests, with an example restoration report. The final part covers incident response and business continuity: the phases of a response, who does what, escalation criteria, keeping an offline copy of the plan, and handling internal and external communication with staff, clients, regulators and the media. The session closes with guidance on working with outside forensics, legal and privacy advisors, two real cases from the speaker’s practice, and an answer on detecting attackers who may already be inside your systems.

Topics covered

• How ransomware disrupts operations and exposes client data
• Common attack routes: phishing, brand impersonation, stolen and reused credentials, and excessive privileges
• A 2026 case study: from a junior employee’s inbox to an attempted fraudulent fund transfer
• Lessons learned: MFA, email security, monitoring alerts and location-based sign-in controls
• Backup and restoration fundamentals
• Common backup gaps: untested backups, assumptions about cloud and software providers, and privileged IT accounts
• The 3-2-1 backup approach and isolated (offline) copies
• Immutable backups, retention periods and separating backup administration
• Recovery objectives: how much data the firm can afford to lose and how fast systems must be restored
• Restoration testing: monthly, quarterly and annual schedules
• A restoration framework: scope, backup selection, isolated environment, documentation, validation and reporting
• Incident response phases: detection, investigation, containment, eradication, recovery and documentation
• Incident response plan structure, roles and escalation criteria
• Business continuity: business impact analysis, minimum operating levels, departmental procedures and offline plan copies
• Internal and external crisis communication
• Working with external forensics, security, legal and privacy advisors
• Security operations center (SOC) as a service for detecting hidden threats
• The ransomware readiness checklist