Ransomware Hit Your Tax Practice? Cobb County CPA Incident Response Protocol

Ransomware Recovery Day 2: Safely Rebuilding Identity and Systems After Containment

Key Takeaways

• Never cut power to an active SQL host — abrupt shutdown corrupts .mdf/.ldf files and can extend recovery from 12-24 hours to 6+ days.
• Downtime costs roughly $6,800/hour in combined direct operational loss and accruing regulatory liability during peak season.
• FTC Safeguards Rule breach notification is due within 30 days of discovery for incidents affecting 500+ consumer records, with per-violation penalties up to $53,088.
• Georgia law (O.C.G.A. § 10-1-912) requires notice to affected residents "without unreasonable delay," and third-party processors must notify the data owner within 24 hours.

What Should a Cobb County CPA Firm Do in the First 15 Minutes of a Ransomware Attack?

Disconnect physical Ethernet cables and disable virtual network adapters on affected hypervisors — leave every server powered on. This stops lateral encryption spread without destroying the volatile memory needed to recover or bypass encryption keys.

Do not unplug the SQL server, the domain controller, or the NAS chassis. Do not run a full antivirus scan yet — that can overwrite forensic artifacts. Network-level logical isolation, not power interruption, is the correct first move, and the difference determines whether your firm is back in production in a day or down for a week.

How Do You Know It's Ransomware and Not Just a Server Crash?

Tax software freezing with a repeating "database engine connection lost" loop, combined with files renamed to a .crypt or unfamiliar suffix, confirms active encryption — not hardware failure.

Look for these concurrent symptoms:

• UltraTax CS, CCH Axcess, or Drake Tax stuck mid-transaction.
• Client PDFs and tax organizers renamed with unknown malicious extensions.
• NAS units and backup arrays disconnecting from hypervisors with "Repository wiped" or "Storage disconnected" console logs.
• Extreme latency across domain workstations as the encryption sweep runs.

A storm-related UPS failure can mimic some of this (database corruption from sudden power loss), which is why log analysis — not assumption — drives the next step.

Which Windows Event Log IDs Confirm an Active Intrusion?

Event IDs 4625, 1102, and 7045 are the three log identifiers forensic responders check first.

Pull these from every domain controller and database host, not just the first machine that alerted — lateral movement usually precedes the encryption event by hours or days.

What Commands Identify Active C2 Channels and Malicious Processes?

Run netstat -ano first to map every active socket routing to external IPs — that's your live exfiltration and command-and-control map.

netstat -ano

To isolate processes actively encrypting the file system:

Get-Process | Where-Object {$_.Description -match "Crypto"}

To check for backdoor admin accounts created during attacker dwell time:

net localgroup administrators

Before eradication, preserve evidence. Export the registry hive to analyze attacker-modified service parameters:

reg export HKLM\SYSTEM C:\ir\SYSTEM.reg

Then capture a full memory dump of any live ransomware process with Sysinternals ProcDump:

procdump.exe -ma <PID> C:\ir\ransomware_memdump.dmp

Active encryption keys and attacker config files live in volatile RAM. A hard reboot destroys them — and with them, your shot at decryption without paying.

Why Should You Never Pull the Power Cord During an Active Encryption Event?

Cutting power mid-transaction corrupts the SQL .mdf and .ldf files, converting a same-day restoration into a multi-day, sector-by-sector rebuild.

Correct containment is physical Ethernet disconnection, disabled iSCSI initiators, and perimeter firewall blocking of C2 IPs — with the chassis left powered on.

What Does Ransomware Downtime Actually Cost a Tax Practice, Per Hour?

Downtime cost is non-linear: it's the sum of idle labor waste, lost billable revenue, and accruing regulatory liability — and it compounds by the hour, not the day.

$$C_{hourly} = L_{idle} + R_{drain} + V_{liability}$$

Where $L_{idle}$ is idle staff labor cost, $R_{drain}$ is lost billable preparation revenue, and $V_{liability}$ is the accruing regulatory/contractual exposure rate. Applied to a mid-market Cobb County practice:

$$C_{hourly} \approx \$5{,}300\text{/hr (direct operational)} + \$1{,}500\text{/hr (regulatory accrual)} = \$6{,}800\text{/hr}$$

What Federal Rules Apply — GLBA, the FTC Safeguards Rule, and the IRS WISP?

CPA and tax firms are legally classified as "financial institutions" under GLBA, requiring a written Information Security Program with mandatory MFA, encryption at rest and in transit, and documented third-party oversight.

Under the FTC Safeguards Rule breach notification amendment (16 CFR Part 314), covered firms must notify the FTC electronically no later than 30 days after discovering a security event compromising the unencrypted nonpublic personal information (NPI) of 500 or more consumers. Unauthorized access to unencrypted NPI is presumed reportable unless forensic logging proves otherwise.

Penalties are severe: up to $100,000 per violation for the institution, up to $10,000 and five years imprisonment for individual officers, with the current inflation-adjusted maximum civil penalty set at $53,088 per violation — and each affected record or day of non-compliance can count separately.

During an FTC audit following a reported breach, investigators typically request the firm's written ISP, the incident timeline and forensic log records, MFA enforcement proof across all administrative and user accounts, and documented third-party vendor risk assessments.

Separately, under IRS Publications 5708 and 5709, every tax preparer must maintain an active WISP. In a suspected breach, contact the assigned IRS Stakeholder Liaison immediately (202-317-4015, cl.sl.area.4@irs.gov) so client SSNs and PTINs can be flagged to block fraudulent filings.

What Does Georgia Law (O.C.G.A. § 10-1-912) Require?

Georgia's Personal Identity Protection Act requires notice "in the most expedient time possible and without unreasonable delay" — there's no fixed day count, but 30 days is the de facto industry standard.

"Personal information" under the statute means a resident's name combined with an unencrypted SSN, driver's license number, state ID, or financial account credentials. A common myth: firms assume they have a hard 30- or 45-day legal window like other states. Georgia doesn't set one — "unreasonable delay" is the standard, and waiting the full 30 days by default can itself become the violation if discovery-to-notice timelines look dilatory.

Third-party data processors must notify the primary data owner within 24 hours of discovering a breach. If a single event requires notifying more than 10,000 Georgia residents, the firm must also notify Equifax, Experian, and TransUnion of the notice timing, distribution, and content.

Who Do You Call Locally in Cobb County?

File with the Cobb County Sheriff's Office Forgery and Fraud Unit (770-499-4752, 185 Roswell Street, Marietta, GA 30060) for computer crime and identity fraud investigation; escalate to the FBI Atlanta Field Office for interstate or international exfiltration.

The Sheriff's Office Criminal Investigation Division handles computer forgery and identity theft locally, and can deploy a specialized Electronic Detection K9 to locate hidden storage media during physical evidence collection. For threat actor infrastructure outside Georgia — which is most ransomware crews — the FBI Atlanta Field Office (3000 Flowers Road South, Atlanta, GA 30341) is the correct federal contact.

Will Thomson Reuters, Wolters Kluwer, or Drake Software Help Recover Your Files?

No — tax software vendors will assert their application code is functioning normally and decline to assist with encrypted SQL recovery, a position their EULAs and MSAs explicitly support.

Expect the vendor to point at your local OS, Active Directory configuration, endpoint security, or backup infrastructure as the failure point. This isn't a support gap you can escalate around — it's the contractual line drawn around their liability. Recovery is your infrastructure team's responsibility, not theirs.

Why Restoring From Yesterday's Backup Can Re-Infect Your Network

Wiping drives and restoring from an unverified daily backup is the single most common cause of immediate re-encryption — modern ransomware dwells silently for weeks before detonating, and it embeds itself in backup storage along the way.

Rushing unverified backup files back into production wakes the dormant payload, which harvests domain credentials from memory and re-encrypts the network within hours.

The fix is a sandboxed Secure Restore Protocol using a platform like Veeam Backup & Replication:

1. Mount the backup image onto an isolated, non-production Mount Server with no routing path to production or the internet.
2. Run a multi-layered scan of the raw data — updated AV signatures, YARA rule matching, and anomaly detection — before anything touches production.
3. If malware is detected, abort the restore and flag the image as infected for isolated analysis.
4. If clean, restore to production.

Going forward, migrate backups to a Linux-based hardened repository with native immutability, and enforce the 3-2-1-1-0 rule: 3 copies of data, on 2 different media types, with 1 copy offsite, 1 copy immutable or offline, and 0 errors confirmed through recovery verification testing.

The Full Crisis Playbook, Phase by Phase

Containment → Forensics → Regulatory Notification → Sandboxed Recovery, in that order — skipping or reordering any phase is what turns a 24-hour incident into a 6-day one.

1. Immediate Containment: Disconnect physical Ethernet, disable virtual adapters, keep all SQL hosts and domain controllers powered on.
2. Forensic Diagnostics: Run netstat -ano, isolate high-entropy processes, audit local admin groups, export the registry hive, capture a ProcDump memory dump, and clone storage with hardware write-blockers.
3. Regulatory and Law Enforcement Reporting: Notify the IRS Stakeholder Liaison, file with the Cobb County Sheriff's Forgery and Fraud Unit, and submit the FTC notification within 30 days if 500+ records are affected.
4. Sandboxed Recovery: Restore exclusively through an isolated mount server with AV/YARA scanning, then migrate to an immutable Linux repository, enforce MFA firm-wide, and update the WISP.

Isolate Your Infrastructure with IT Emergency Room

Every hour of indecision past the first 15 minutes costs your practice roughly $6,800 and moves you closer to a 6-day, six-figure outage with mandatory regulatory disclosure attached. IT Emergency Room is the Cobb County Tier-3 on-site escalation unit for active ransomware events — forensic containment, sandboxed Veeam-based recovery, and regulatory coordination with the IRS Stakeholder Liaison, Cobb County Sheriff's Office, and FTC notification requirements, handled in parallel by responders who do this during peak filing season specifically.