“This became the turning point for our business.” — Francis West, Founder & CEO, Security Everywhere
Note: This is a true story. The company name and identifying details have been changed to protect the identity of this client.
Background
This recruitment agency specialised in healthcare and care staffing — around 35 people in-house, placing over 800 nurses and care staff into hospitals and care homes across the country every week.
For two years before the attack, Security Everywhere had recommended moving their on-site backups into the cloud, migrating email off a local server onto Office 365, upgrading their firewall, and a number of other security improvements. Each time, the agency agreed in principle — and each time, the investment was put off for another quarter.
It’s a familiar story, and not a shameful one. Budgets are tight, priorities compete, and “we’ll get to it next quarter” feels like a reasonable call right up until it isn’t.
The Risk
A few days after yet another conversation about the same recommendations — over a bank holiday weekend, at 5am on the Saturday — Security Everywhere’s Network Operations Centre detected and interrupted an active attack already under way inside the agency’s network.
By the time it was stopped, the attackers had already encrypted all three of the agency’s servers — email, database, and file — and were partway through encrypting the on-site backups too.
This is the part regulated businesses need to sit with: attackers increasingly go after backups first, specifically because they know backups are the way out. According to Veeam’s 2025 Ransomware Trends Report, 89% of organisations hit by ransomware in 2025 say the attackers specifically targeted their backups. Isolated, tested backups aren’t a nice-to-have — they’re the difference between a bad week and a business-threatening one.
What We Did
It took two weeks to recover what could be salvaged from the backups. For almost that entire period, the agency couldn’t place a single one of its 800-plus nursing and care staff into a shift — costing tens of thousands of pounds in lost placements, on top of a £29,000 bill to recover their files and data.
In that same two-week window, Security Everywhere rebuilt the agency’s IT from the ground up:
- Migrated email to Office 365
- Implemented email security
- Deployed SentinelOne endpoint protection across every computer and the file server, backed by our 24/7, 200-strong Security Operations Centre
- Rolled out password management
- Secured every mobile device with dedicated mobile security
These are the same layers of protection Security Everywhere runs for itself.
The Result
Since that two-week period, the agency has not had so much as a hint of another attack.
“All of this could have been avoided if only they’d agreed to do what our advice was at the time. I think this was our big turning point as a business — to make sure every client has the same level of protection we rely on ourselves, because we don’t want any other business to go through that pain, or to go through it ourselves.”
— Francis West, Founder & CEO, Security Everywhere
What This Means for Recruitment Agencies
A recruitment business’s entire value is its ability to place people, fast. When the systems behind that stop working — even for two weeks — the damage isn’t abstract. It’s every shift that didn’t get filled, every candidate who couldn’t be placed, and every client who had to look elsewhere in the meantime.
Backups only help if attackers can’t reach them too. Advice only helps if it gets acted on before the bank holiday weekend it’s needed, not after.
Recovery within a week is achievable — Sophos’s State of Ransomware 2025 report found 53% of ransomware victims recovered within a week. This agency took two, partly because their backups were under attack as well.
Isolated, tested backups and layered security aren’t optional extras — especially for recruitment agencies working toward Cyber Essentials, which is increasingly required to win NHS, government, and enterprise framework contracts.
If This Sounds Familiar
If you’ve been meaning to sort out your backups, your email security, or your endpoint protection — and it keeps sliding to next quarter — you’re not alone, and it’s not too late. We’d rather help you close the gap now than write your case study later.
Book a free Security Check and we’ll show you exactly where the gaps are.
Run a recruitment agency? Our cyber security for recruitment agencies page sets out where firms like this one actually get hit, and what to put in place first.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
