Seven-Location BBQ Restaurant Group
This Southwest US restaurant group hired us because their last ransomware attack cost them a $40,000 ransom. The next attack — a 7-Bitcoin demand on a Saturday — cost them 4.5 hours and nothing. In between, one custom dashboard replaced more than $29,000 a year in subscriptions.
The group came to NetSys the way too many businesses do: after the incident. Ransomware had locked their systems, and with no tested way back they paid the $40,000 demand. That check is what turned modernization from a someday project into a mandate.
The day-to-day picture had its own leak. Seven locations ran on Toast for point of sale, Uber Eats and Grubhub for delivery, Google Analytics and Search Console for the web — and a stack of subscription tools (SEMrush and a rotating cast of marketing, loyalty, and messaging platforms) bolted on top to make sense of it all. The subscriptions totaled more than $29,000 a year, and ownership still couldn't see all seven locations in one place.
The approach
One dashboard instead of a subscription stack
We built the group a single custom dashboard that pulls Toast sales, Uber Eats and Grubhub orders, and Google Analytics and Search Console data for every location into one live view — with text and email campaign blasts and a customer loyalty program built in. One-time build: $22,000. The subscriptions it replaced — more than $29,000 every year — were cancelled, so the build paid for itself in about nine months.
Infrastructure out of the back office
The aging on-premise servers moved to Microsoft Azure with licensing cleaned up along the way, plus business-grade firewalls and domain protection. Four months of build, then a five-month rollout across all seven locations without interrupting service hours.
Assume the next attack
Given their history we designed for the day it happens again: immutable backups that ransomware cannot encrypt, tested restore procedures with the timings written down, and 24/7 monitoring. The point was never to promise no more incidents — it was to make the next one survivable on our terms.
The Saturday it paid off
About two months after the hardening was complete, ransomware hit again — a demand of 7 Bitcoin, on a Saturday. This time nobody negotiated. NetSys isolated the affected systems and restored from immutable backups; the group was fully operational in 4.5 hours with 100% of its data. The demand went unanswered.
- Custom multi-location analytics dashboard
- Toast POS + Uber Eats + Grubhub integrations
- Google Analytics + Search Console rollup
- Built-in SMS/email campaigns + loyalty program
- Azure migration + licensing cleanup
- Immutable backups + tested restores
- Business-grade firewalls + domain protection
- 24/7 monitoring & response
The results
The first incident predates the engagement — with no tested recovery path, the group paid. The second incident ended with a 4.5-hour restore from immutable backups on a Saturday; the 7-BTC demand went unanswered.
View data table
| Ransom paid ($ thousands) | |
|---|---|
| Before NetSys | 40 |
| With NetSys defenses | 0 |
More case studies
Start with a free assessment — or the pen test.
Every engagement above began the same way: an honest look at where things stood. Take a scored assessment online, or book a free on-site penetration test and see your environment the way an attacker does.