The Night the Backups Went Silent

It began with a hollow thump in the silence, a heartbeat under the floorboards. 

October 31st. A Friday night, and the building was empty. Alex walked the corridor. A mug gone cold in his hand, the taste of burnt coffee clinging to the tongue. Fluorescent lights hummed overhead, and the server room exhaled in slow, mechanical sighs. Halloween decorations sagged in the corners. Rows of cubicles dressed in paper bats and ghosts with grins too wide. Plastic cobwebs that seemed too real in the half-light.

Somewhere, a draft whispered through the vents, a voice that didn’t belong. 

The migration had finished. Or said it had. The dashboard glowed green, promising a running system and complete data. Outside, wind scraped dead leaves across the pavement. Inside, the first alert came. A workstation chirping about antivirus.  

Then another.  

Then the error. One line, stark and final: Encrypted. 

The ransom note spread. Screens around him turned black. Logs filled with whispers of failed opens, corrupted files, polite demands for payment. The kind of politeness that makes your stomach knot. Alex reached for the backups because that’s what you do when the floor drops out. The console was still green, still smiling. But when the restore spun, it spun too long. Then it failed. 

And in that silence, Alex heard it again: thump-thump… thump-thump… The heartbeat of something buried deep. Warnings ignored, replication errors weeks old, pulsing under the dashboard’s false calm. The backups were there, brittle as old bones left too long in the sun. Alex’s eyes found the laminated sheet on the wall, ink-black letters whispering acronyms: RPO, RTO, DR. Boxes were checked. Notes were taken. The drills had been rehearsed like fire evacuations that no one expected to need. Tonight, the hallway was smoky. 

The malware wasn’t clever. It didn’t need to be. A service account with too much reach. A sleepy SMB share is mapped where it shouldn’t be. The infection followed credentials like blood scent in water. It burned through volumes, left ransom notes like teeth marks.  

Where trust ended, it stopped.  

Trust, it turned out, ended at the vault. 

Months ago, someone had fought for that vault. Immutable, air-gapped, expensive insurance against ghosts no one believed in. Write once, lock for thirty days. A superstition, they’d called it. Rosemary over the door. Tonight, superstition was salvation. 

Alex pivoted hard, fingers moving like prayers. The vault didn’t know the ransom note. Its snapshots were cold, untouched. The first restore landed clean. Logs ticking away. Not everything was saved—some hours would stay dead—but the heart of the business beat again… thump-thump… thump-thump… louder now, but steady. 

In the war room, coffee cooled while voices sharpened. Legal drafted apologies. Finance counted losses. Security traced footprints through the snow. Alex wrote in the margins of the runbook: Immutable by default. Least privilege. Separate credentials. Real drills, not Friday theater. The 3-2-1 rule carved like scripture: three copies, two media, one offsite.

Morning came gray and thin. The ransom note looked smaller in daylight, but the ghosts stayed. Not the kind with chains and moans—the kind that live in habits. Ignored alerts. Green dashboards that lie. Permissions that sprawl like weeds. The frightening part isn’t that bad things happen. It’s how quietly they do when you stop listening for the creak of floorboards you thought were solid. 

That night added one more line to the runbook, underlined twice: 
Backups aren’t a feeling. They’re proof. Earned before the storm. Verified after the drill. Kept somewhere the monsters can’t reach. 

And as Alex closed the console, he heard it... thump-thump… thump-thump… still beating, somewhere deep.