What happened
VSK is one of Russia's largest insurers, with revenue of about USD 1.6 billion. In November 2025, the company was hit by a ransomware attack. On the seventh day of downtime, its website and mobile app were still not working, its domain pointed to a fraudulent channel, and customers could not buy policies or receive payouts. Full recovery took at least a week.
For a business of this size, a week of downtime in key services means direct revenue losses. It also damages customer trust and reputation. The main lesson goes beyond this one company: a prepared business continuity system could have cut the downtime to a few days.
Which BCM mechanisms reduce losses
A cyberattack is more than an IT task. It is a scenario you prepare for in advance. Here is what actually cuts downtime:
- Business impact analysis (BIA) of critical processes and recovery targets (RTO/RPO). When priorities are set in advance, the team does not lose hours on approvals during the attack. Everyone knows what to bring back first and how fast.
- Detailed, tested business continuity plans (BCP) with clear areas of responsibility. Everyone involved, from IT to the front office, knows what to do in the first hours of an incident.
- Regular exercises and team training. A rehearsal of the ransomware scenario exposes gaps before a real attack and sharpens how departments work together.
The main takeaway
Luck and the size of the IT budget do not decide whether a company is “down for a week” or “back in two days”. What decides it is priorities calculated in advance (BIA), recovery time objectives (RTO/RPO) and a tested plan that the whole team knows. For how to measure this, see “How to measure and test business resilience”.
You can find out in advance how many days your own recovery would take with a ransomware readiness check: together with your IT team we restore a system from a backup and time it.
Timeline of the seven days of downtime
| Period | What happens | The lesson |
|---|---|---|
| Day 1 | Ransomware stops systems; the website and app are unavailable | The first hours decide the scale of the damage (first-hours plan) |
| Days 2-3 | Assessing the scale; customers are not served; the call centre is overloaded | Workaround processes and communication templates must be ready in advance |
| Days 4-5 | Restoring from backups, integrity checks | Untested backups are a lottery |
| Days 6-7 | Services come back step by step; incident review | Reputational damage surfaces later than financial damage |
| After | Customer churn, questions from the regulator, a review of security | Preparing in advance would have been cheaper |
Frequently asked questions
What are RTO and RPO?
RTO is the maximum acceptable time to restore a process. RPO is the acceptable amount of data loss. These metrics set how quickly a function must be brought back and how much data can be lost without critical consequences.
How does ISO 22301 help an ordinary company?
The standard sets out the logic: identify critical processes, set recovery time targets, then prepare and test plans. You do not have to get certified: the methodology itself is useful.
How do you prepare for a ransomware attack?
At a minimum: isolated backups, roles assigned in advance for the first hours of an incident, a plan for communicating with customers, and regular exercises on this scenario.
Is your team ready for the first hour of a crisis?
You test a plan by running a scenario. Reading it is not enough. The assessment shows the gaps, and the corporate format works through them with your team on your own processes.
