Ransomware Took Them. 158 Years Gone.
This is what it looks like when recovery fails.
In 2023, KNP Logistics - a UK haulage firm tracing its roots back to 1865 - collapsed. Not due to a market downturn. Not because of poor leadership. But because of ransomware. The attack locked systems, corrupted backups, halted operations, and ultimately led to the company entering administration. More than 700 jobs were lost.
If you run a business, or you're the one responsible when systems go down, this isn't just a cautionary tale. It's a blueprint for what not to do - and what must change.
How They Got In
One password. No MFA. No way back.
The attackers - believed to be the Akira ransomware gang - accessed KNP’s internal systems through a guessed password, according to BBC reports. The account didn’t have multi-factor authentication. That was all it took.
Once inside, the gang moved laterally, encrypted servers, and locked not only KNP’s live data - but their backups too. The ransom demand? Estimated to be in the millions. But even partial payment didn’t fix the problem. Operations were paralysed. No restores. No options.
The Resulting Collapse
Operations stopped. Customers left. Staff were told too late.
With logistics systems offline, KNP couldn’t dispatch vehicles, manage warehouses, or communicate with customers. Over 500 lorries and trailers were parked. Deliveries failed. Even major clients like M&S experienced knock-on impacts.
Employees worked unpaid for weeks, hoping recovery was coming. It wasn’t. On 25 September 2023, KNP officially entered administration. Most of the workforce was made redundant. Administrators confirmed: “The ransomware attack was the key factor in the business's collapse.”
What Went Wrong Technically
Security in name only. Backups exposed. No fallback plan.
KNP had backups - but they weren’t isolated. The attackers encrypted them too. The company had cyber insurance - but insurance doesn’t restore operations. The IT team had plans - but no rehearsed rebuild. There was no clean recovery path.
These are the same gaps we still see every day: backups on the same network, no air gap, no immutability, no recovery drill. Until they’re fixed, another KNP is always around the corner.
How This Could Have Ended Differently
With the right setup, KNP could still be operating today.
These are the four controls that change the outcome:
1. Immutable, air-gapped backups
If KNP had used Rismor’s Cloud Backup, the encrypted systems
would have been restored from an off-network snapshot the attackers couldn't reach.
Backups checked daily. Versioned. Tamper-proof.
2. Log-level threat monitoring
The intrusion could have been caught early. Our hosted Police CyberAlarm turns firewall logs and endpoint events into monthly reports that surface abnormal behaviour.
You don’t need to watch - we do.
3. Segmented recovery and rebuild
Once hit, the difference between a month offline and a day is a clean recovery path.
Our systems can rebuild yours offsite, clean, and safely - so operations resume fast,
not after insolvency.
4. Trained access controls
That guessed password? It never should have worked. With enforced MFA and
secure onboarding, entry-level mistakes like this
don’t happen. And if someone tries? We see it.
What This Means for You
If your backups can be deleted, they’re not backups.
Ransomware is no longer just a “cyber” risk. It’s a business-ending event. Your defences, your recovery paths, your ability to continue trading - these are board-level priorities now. And most businesses still treat them like IT housekeeping.
If that feels too familiar, you don’t need a complete overhaul. You need a quiet, clean fix: Air-gapped backup. Threat visibility. MFA-first identity setup. Calm, tested continuity plans.
Your Move
Backups you can trust. Threats you can see. Recovery you’ve rehearsed.
What happened to KNP isn’t rare. It’s just usually hidden. This time, the admin notice made it public. Next time, it could be quieter - but just as final.
If you’re reading this, it means you still have time to fix it. Ask us a question. Or see how the backup works. Or check the price and get started. Quietly. Now.
Because the only thing worse than a ransomware attack… is not coming back from it.