A scenario in which all corporate files are taken hostage by ransomware. The document walks through the situation in detail and the response steps - identifying the incident, containing its spread, removing the malware, and restoring systems - giving organizations a starting point for building a proactive ransomware prevention and response process.